{"grype_matches":[{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9680","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9680","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9680","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-9680","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9680","date":"2026-11-12","epss":0.23184,"percentile":0.97795}],"risk":82.5,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9680","knownExploited":[{"cve":"CVE-2024-9680","cwes":["CWE-416"],"urls":["https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/","https://nvd.nist.gov/vuln/detail/CVE-2024-9680"],"dueDate":"2024-11-05","product":"Firefox","dateAdded":"2024-10-15","vendorProject":"Mozilla","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"known"}]},"relatedVulnerabilities":[{"id":"CVE-2024-9680","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9680","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-9680","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9680","date":"2026-11-12","epss":0.23184,"percentile":0.97795}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1923344","https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-49039","https://www.mozilla.org/security/advisories/mfsa2024-51/","https://www.mozilla.org/security/advisories/mfsa2024-52/","https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=281992","https://lists.debian.org/debian-lts-announce/2024/10/msg00005.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9680"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9680","description":"An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability affects Firefox < 131.0.2, Firefox ESR < 128.3.1, Firefox ESR < 115.16.1, Thunderbird < 131.0.1, Thunderbird < 128.3.1, and Thunderbird < 115.16.0.","knownExploited":[{"cve":"CVE-2024-9680","cwes":["CWE-416"],"urls":["https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/","https://nvd.nist.gov/vuln/detail/CVE-2024-9680"],"dueDate":"2024-11-05","product":"Firefox","dateAdded":"2024-10-15","vendorProject":"Mozilla","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"known"}]}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0242","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0242","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0242","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0242","date":"2026-11-12","epss":0.14716,"percentile":0.9672}],"risk":7.3580000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0242"},"relatedVulnerabilities":[{"id":"CVE-2025-0242","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0242","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0242","date":"2026-11-12","epss":0.14716,"percentile":0.9672}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1874523%2C1926454%2C1931873%2C1932169","https://www.mozilla.org/security/advisories/mfsa2025-01/","https://www.mozilla.org/security/advisories/mfsa2025-02/","https://www.mozilla.org/security/advisories/mfsa2025-03/","https://www.mozilla.org/security/advisories/mfsa2025-04/","https://www.mozilla.org/security/advisories/mfsa2025-05/","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0242","description":"Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0247","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0247","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0247","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-0247","date":"2026-11-12","epss":0.10695,"percentile":0.95876}],"risk":5.3475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0247"},"relatedVulnerabilities":[{"id":"CVE-2025-0247","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0247","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-0247","date":"2026-11-12","epss":0.10695,"percentile":0.95876}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1835193%2C1910021%2C1919803%2C1931576%2C1931948%2C1932173","https://www.mozilla.org/security/advisories/mfsa2025-01/","https://www.mozilla.org/security/advisories/mfsa2025-04/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0247","description":"Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 134 and Thunderbird 134."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-4918","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4918","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-4918","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4918","date":"2026-11-12","epss":0.09515,"percentile":0.95518}],"risk":4.7575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4918"},"relatedVulnerabilities":[{"id":"CVE-2025-4918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4918","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-4918","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4918","date":"2026-11-12","epss":0.09515,"percentile":0.95518}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1966612","https://www.mozilla.org/security/advisories/mfsa2025-36/","https://www.mozilla.org/security/advisories/mfsa2025-37/","https://www.mozilla.org/security/advisories/mfsa2025-38/","https://www.mozilla.org/security/advisories/mfsa2025-40/","https://www.mozilla.org/security/advisories/mfsa2025-41/","https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html","https://www.vicarius.io/vsociety/posts/cve-2025-4918-detect-firefox-out-of-bounds-write","https://www.vicarius.io/vsociety/posts/cve-2025-4918-mitigate-firefox-out-of-bounds-write"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4918","description":"An attacker was able to perform an out-of-bounds read or write on a JavaScript `Promise` object. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-4919","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4919","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-4919","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4919","date":"2026-11-12","epss":0.09115,"percentile":0.95379}],"risk":4.5575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4919"},"relatedVulnerabilities":[{"id":"CVE-2025-4919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4919","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-4919","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4919","date":"2026-11-12","epss":0.09115,"percentile":0.95379}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1966614","https://www.mozilla.org/security/advisories/mfsa2025-36/","https://www.mozilla.org/security/advisories/mfsa2025-37/","https://www.mozilla.org/security/advisories/mfsa2025-38/","https://www.mozilla.org/security/advisories/mfsa2025-40/","https://www.mozilla.org/security/advisories/mfsa2025-41/","https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4919","description":"An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6424","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-6424","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6424","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-6424","date":"2026-11-12","epss":0.079,"percentile":0.94794}],"risk":3.95,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6424"},"relatedVulnerabilities":[{"id":"CVE-2025-6424","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6424","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-6424","date":"2026-11-12","epss":0.079,"percentile":0.94794}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1966423","https://www.mozilla.org/security/advisories/mfsa2025-51/","https://www.mozilla.org/security/advisories/mfsa2025-52/","https://www.mozilla.org/security/advisories/mfsa2025-53/","https://www.mozilla.org/security/advisories/mfsa2025-54/","https://www.mozilla.org/security/advisories/mfsa2025-55/","https://lists.debian.org/debian-lts-announce/2025/06/msg00029.html","https://lists.debian.org/debian-lts-announce/2025/07/msg00002.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6424","description":"A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8381","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8381","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8381","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8381","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8381","date":"2026-11-12","epss":0.04395,"percentile":0.91446}],"risk":2.1975000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8381"},"relatedVulnerabilities":[{"id":"CVE-2024-8381","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8381","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8381","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8381","date":"2026-11-12","epss":0.04395,"percentile":0.91446}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1912715","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-41/","https://www.mozilla.org/security/advisories/mfsa2024-43/","https://www.mozilla.org/security/advisories/mfsa2024-44/","https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8381","description":"A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6436","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-6436","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6436","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-6436","date":"2026-11-12","epss":0.04256,"percentile":0.91194}],"risk":2.128,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6436"},"relatedVulnerabilities":[{"id":"CVE-2025-6436","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6436","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-6436","date":"2026-11-12","epss":0.04256,"percentile":0.91194}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1941377%2C1960948%2C1966187%2C1966505%2C1970764%2C1942930","https://www.mozilla.org/security/advisories/mfsa2025-51/","https://www.mozilla.org/security/advisories/mfsa2025-54/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6436","description":"Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 140 and Thunderbird 140."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6770","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6770","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6770","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6770","date":"2026-11-12","epss":0.03883,"percentile":0.90375}],"risk":1.9415000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6770"},"relatedVulnerabilities":[{"id":"CVE-2026-6770","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6770","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6770","date":"2026-11-12","epss":0.03883,"percentile":0.90375}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2024220","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6770","description":"Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1009","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1009","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1009","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1009","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1009","date":"2026-11-12","epss":0.01199,"percentile":0.68577}],"risk":0.5995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1009"},"relatedVulnerabilities":[{"id":"CVE-2025-1009","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1009","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1009","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1009","date":"2026-11-12","epss":0.01199,"percentile":0.68577}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1936613","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-08/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1009","description":"An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4696","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4696","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4696","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4696","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4696","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4696","date":"2026-11-12","epss":0.00989,"percentile":0.62959}],"risk":0.4945,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4696"},"relatedVulnerabilities":[{"id":"CVE-2026-4696","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4696","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4696","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4696","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4696","date":"2026-11-12","epss":0.00989,"percentile":0.62959}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2020190","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4696","https://bugzilla.redhat.com/show_bug.cgi?id=2450740","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4696.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4696","description":"Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74943","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74943","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74943","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74943","date":"2026-11-12","epss":0.00961,"percentile":0.62019}],"risk":0.48050000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74943"},"relatedVulnerabilities":[{"id":"CVE-2026-74943","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74943","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74943","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74943","date":"2026-11-12","epss":0.00961,"percentile":0.62019}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2057308","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-75/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74943","description":"Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2796","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2796","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2796","date":"2026-11-12","epss":0.00948,"percentile":0.61643}],"risk":0.47400000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2796"},"relatedVulnerabilities":[{"id":"CVE-2026-2796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2796","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2796","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2796","date":"2026-11-12","epss":0.00948,"percentile":0.61643}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013165","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://access.redhat.com/security/cve/CVE-2026-2796","https://bugzilla.redhat.com/show_bug.cgi?id=2442301","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2796.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2796","description":"JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6746","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6746","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6746","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6746","date":"2026-11-12","epss":0.00946,"percentile":0.61572}],"risk":0.473,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6746"},"relatedVulnerabilities":[{"id":"CVE-2026-6746","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6746","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6746","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6746","date":"2026-11-12","epss":0.00946,"percentile":0.61572}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014596","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-31/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6746","https://bugzilla.redhat.com/show_bug.cgi?id=2460112","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6746.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6746","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4700","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4700","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4700","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4700","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4700","date":"2026-11-12","epss":0.00938,"percentile":0.61352}],"risk":0.469,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4700"},"relatedVulnerabilities":[{"id":"CVE-2026-4700","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4700","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4700","cwe":"CWE-444","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4700","date":"2026-11-12","epss":0.00938,"percentile":0.61352}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2003766","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4700","https://bugzilla.redhat.com/show_bug.cgi?id=2450752","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4700.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4700","description":"Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2773","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2773","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2773","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2773","date":"2026-11-12","epss":0.00917,"percentile":0.60693}],"risk":0.45849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2773"},"relatedVulnerabilities":[{"id":"CVE-2026-2773","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2773","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2773","date":"2026-11-12","epss":0.00917,"percentile":0.60693}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014832","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2773","https://bugzilla.redhat.com/show_bug.cgi?id=2442319","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2773.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2773","description":"Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112314","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112314","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"risk":0.4575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112314"},"relatedVulnerabilities":[{"id":"CVE-2026-112314","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112314","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112314","date":"2026-11-12","epss":0.00915,"percentile":0.60614}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112314","https://bugzilla.redhat.com/show_bug.cgi?id=2478446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112314","description":"clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11704","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11704","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11704","date":"2026-11-12","epss":0.00913,"percentile":0.60559}],"risk":0.45649999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11704"},"relatedVulnerabilities":[{"id":"CVE-2024-11704","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11704","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11704","date":"2026-11-12","epss":0.00913,"percentile":0.60559}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1899402","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-67/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11704","description":"A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under specific conditions, the same symmetric key could have been freed twice, potentially leading to memory corruption. This vulnerability affects Firefox < 133, Thunderbird < 133, Firefox ESR < 128.7, and Thunderbird < 128.7."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112321","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"risk":0.44999999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112321"},"relatedVulnerabilities":[{"id":"CVE-2026-112321","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112321","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112321","date":"2026-11-12","epss":0.009,"percentile":0.60134}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112321","https://bugzilla.redhat.com/show_bug.cgi?id=2478448"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112321","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-3028","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-3028","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-3028","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-3028","date":"2026-11-12","epss":0.0087,"percentile":0.59271}],"risk":0.43499999999999994,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-3028"},"relatedVulnerabilities":[{"id":"CVE-2025-3028","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3028","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-3028","date":"2026-11-12","epss":0.0087,"percentile":0.59271}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1941002","https://www.mozilla.org/security/advisories/mfsa2025-20/","https://www.mozilla.org/security/advisories/mfsa2025-21/","https://www.mozilla.org/security/advisories/mfsa2025-22/","https://www.mozilla.org/security/advisories/mfsa2025-23/","https://www.mozilla.org/security/advisories/mfsa2025-24/","https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3028","description":"JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16357","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16357","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16357","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16357","date":"2026-11-12","epss":0.00868,"percentile":0.59213}],"risk":0.434,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16357"},"relatedVulnerabilities":[{"id":"CVE-2026-16357","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16357","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16357","date":"2026-11-12","epss":0.00868,"percentile":0.59213}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2053326","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16357","description":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-10702","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-10702","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-10702","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-10702","cwe":"CWE-733","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-10702","date":"2026-11-12","epss":0.00856,"percentile":0.58876}],"risk":0.428,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-10702"},"relatedVulnerabilities":[{"id":"CVE-2026-10702","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-10702","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-10702","cwe":"CWE-733","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-10702","date":"2026-11-12","epss":0.00856,"percentile":0.58876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2040903","https://www.mozilla.org/security/advisories/mfsa2026-54/","https://access.redhat.com/security/cve/CVE-2026-10702","https://bugzilla.redhat.com/show_bug.cgi?id=2484118","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10702.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-10702","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2774","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2774","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2774","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2774","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2774","date":"2026-11-12","epss":0.00852,"percentile":0.58746}],"risk":0.426,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2774"},"relatedVulnerabilities":[{"id":"CVE-2026-2774","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2774","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2774","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2774","date":"2026-11-12","epss":0.00852,"percentile":0.58746}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014883","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2774","https://bugzilla.redhat.com/show_bug.cgi?id=2442290","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2774.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2774","description":"Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2775","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2775","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2775","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2775","date":"2026-11-12","epss":0.00837,"percentile":0.5824}],"risk":0.41850000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2775"},"relatedVulnerabilities":[{"id":"CVE-2026-2775","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2775","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2775","date":"2026-11-12","epss":0.00837,"percentile":0.5824}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015199","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2775","https://bugzilla.redhat.com/show_bug.cgi?id=2442314","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2775.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2775","description":"Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-50336","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-50336","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-50336","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-50336","date":"2026-11-12","epss":0.00829,"percentile":0.58012}],"risk":0.41450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-50336"},"relatedVulnerabilities":[{"id":"CVE-2024-50336","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-50336","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2024-50336","date":"2026-11-12","epss":0.00829,"percentile":0.58012}],"urls":["https://github.com/matrix-org/matrix-js-sdk/security/advisories/GHSA-xvg8-m4x3-w6xr","https://spec.matrix.org/v1.12/client-server-api/#security-considerations-5","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-50336","description":"matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. matrix-js-sdk before 34.11.0 is vulnerable to client-side path traversal via crafted MXC URIs. A malicious room member can trigger clients based on the matrix-js-sdk to issue arbitrary authenticated GET requests to the client's homeserver. Fixed in matrix-js-sdk 34.11.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4690","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4690","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4690","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4690","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4690","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4690","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4690","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4690","date":"2026-11-12","epss":0.00821,"percentile":0.57772}],"risk":0.41050000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4690"},"relatedVulnerabilities":[{"id":"CVE-2026-4690","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4690","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4690","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4690","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4690","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4690","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4690","date":"2026-11-12","epss":0.00821,"percentile":0.57772}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016375","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4690","https://bugzilla.redhat.com/show_bug.cgi?id=2450732","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4690.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4690","description":"Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4694","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4694","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4694","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4694","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4694","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4694","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4694","date":"2026-11-12","epss":0.0082,"percentile":0.57745}],"risk":0.41000000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4694"},"relatedVulnerabilities":[{"id":"CVE-2026-4694","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4694","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4694","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4694","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4694","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4694","date":"2026-11-12","epss":0.0082,"percentile":0.57745}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2018430","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4694","https://bugzilla.redhat.com/show_bug.cgi?id=2450747","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4694.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4694","description":"Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10466","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10466","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10466","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10466","date":"2026-11-12","epss":0.0081,"percentile":0.57394}],"risk":0.40499999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10466"},"relatedVulnerabilities":[{"id":"CVE-2024-10466","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10466","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10466","date":"2026-11-12","epss":0.0081,"percentile":0.57394}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1924154","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10466","description":"By sending a specially crafted push message, a remote server could have hung the parent process, causing the browser to become unresponsive. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6758","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6758","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6758","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6758","date":"2026-11-12","epss":0.00809,"percentile":0.57368}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6758"},"relatedVulnerabilities":[{"id":"CVE-2026-6758","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6758","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6758","date":"2026-11-12","epss":0.00809,"percentile":0.57368}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013619","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-33/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6758","description":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150 and Thunderbird 150."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11697","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11697","date":"2026-11-12","epss":0.00809,"percentile":0.57354}],"risk":0.40449999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11697"},"relatedVulnerabilities":[{"id":"CVE-2024-11697","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11697","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11697","date":"2026-11-12","epss":0.00809,"percentile":0.57354}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1842187","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-64/","https://www.mozilla.org/security/advisories/mfsa2024-67/","https://www.mozilla.org/security/advisories/mfsa2024-68/","https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11697","description":"When handling keypress events, an attacker may have been able to trick a user into bypassing the \"Open Executable File?\" confirmation dialog. This could have led to malicious code execution. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4698","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4698","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4698","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4698","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4698","cwe":"CWE-733","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4698","date":"2026-11-12","epss":0.00802,"percentile":0.57141}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4698"},"relatedVulnerabilities":[{"id":"CVE-2026-4698","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4698","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4698","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4698","cwe":"CWE-733","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4698","date":"2026-11-12","epss":0.00802,"percentile":0.57141}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2020906","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4698","https://bugzilla.redhat.com/show_bug.cgi?id=2450719","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4698.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4698","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0238","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0238","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0238","date":"2026-11-12","epss":0.00794,"percentile":0.56873}],"risk":0.39699999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0238"},"relatedVulnerabilities":[{"id":"CVE-2025-0238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0238","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0238","date":"2026-11-12","epss":0.00794,"percentile":0.56873}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1915535","https://www.mozilla.org/security/advisories/mfsa2025-01/","https://www.mozilla.org/security/advisories/mfsa2025-02/","https://www.mozilla.org/security/advisories/mfsa2025-03/","https://www.mozilla.org/security/advisories/mfsa2025-04/","https://www.mozilla.org/security/advisories/mfsa2025-05/","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0238","description":"Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112322","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112322","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"risk":0.3895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112322"},"relatedVulnerabilities":[{"id":"CVE-2026-112322","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112322","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112322","date":"2026-11-12","epss":0.00779,"percentile":0.56383}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112322","https://bugzilla.redhat.com/show_bug.cgi?id=2478445"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112322","description":"clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10533","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-10533","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-10533","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-10533","date":"2026-11-12","epss":0.00774,"percentile":0.56241}],"risk":0.387,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-10533"},"relatedVulnerabilities":[{"id":"CVE-2025-10533","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10533","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-10533","date":"2026-11-12","epss":0.00774,"percentile":0.56241}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1980788","https://www.mozilla.org/security/advisories/mfsa2025-73/","https://www.mozilla.org/security/advisories/mfsa2025-74/","https://www.mozilla.org/security/advisories/mfsa2025-75/","https://www.mozilla.org/security/advisories/mfsa2025-77/","https://www.mozilla.org/security/advisories/mfsa2025-78/","https://lists.debian.org/debian-lts-announce/2025/09/msg00026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10533","description":"Integer overflow in the SVG component. This vulnerability was fixed in Firefox 143, Firefox ESR 115.28, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2771","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2771","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2771","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2771","date":"2026-11-12","epss":0.00759,"percentile":0.55728}],"risk":0.3795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2771"},"relatedVulnerabilities":[{"id":"CVE-2026-2771","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2771","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2771","date":"2026-11-12","epss":0.00759,"percentile":0.55728}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014593","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2771","https://bugzilla.redhat.com/show_bug.cgi?id=2442288","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2771.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2771","description":"Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-49710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-49710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-49710","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-49710","date":"2026-11-12","epss":0.00754,"percentile":0.55589}],"risk":0.377,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-49710"},"relatedVulnerabilities":[{"id":"CVE-2025-49710","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-49710","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-49710","date":"2026-11-12","epss":0.00754,"percentile":0.55589}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1970095","https://www.mozilla.org/security/advisories/mfsa2025-47/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-49710","description":"An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4686","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4686","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4686","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4686","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4686","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4686","date":"2026-11-12","epss":0.00745,"percentile":0.55297}],"risk":0.3725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4686"},"relatedVulnerabilities":[{"id":"CVE-2026-4686","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4686","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4686","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4686","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4686","date":"2026-11-12","epss":0.00745,"percentile":0.55297}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016351","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4686","https://bugzilla.redhat.com/show_bug.cgi?id=2450734","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4686.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4686","description":"Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112319","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112319","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"risk":0.371,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112319"},"relatedVulnerabilities":[{"id":"CVE-2026-112319","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112319","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112319","date":"2026-11-12","epss":0.00742,"percentile":0.55155}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112319","https://bugzilla.redhat.com/show_bug.cgi?id=2478684"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112319","description":"The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9401","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9401","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9401","date":"2026-11-12","epss":0.00739,"percentile":0.55066}],"risk":0.3695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9401"},"relatedVulnerabilities":[{"id":"CVE-2024-9401","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9401","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9401","date":"2026-11-12","epss":0.00739,"percentile":0.55066}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1916476","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-48/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/","https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9401","description":"Memory safety bugs present in Firefox 130, Firefox ESR 115.15, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2763","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2763","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2763","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2763","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2763","date":"2026-11-12","epss":0.00737,"percentile":0.55009}],"risk":0.3685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2763"},"relatedVulnerabilities":[{"id":"CVE-2026-2763","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2763","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2763","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2763","date":"2026-11-12","epss":0.00737,"percentile":0.55009}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2012018","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2763","https://bugzilla.redhat.com/show_bug.cgi?id=2442316","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2763.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2763","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2770","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2770","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2770","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2770","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2770","date":"2026-11-12","epss":0.00737,"percentile":0.55009}],"risk":0.3685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2770"},"relatedVulnerabilities":[{"id":"CVE-2026-2770","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2770","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2770","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2770","date":"2026-11-12","epss":0.00737,"percentile":0.55009}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014585","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2770","https://bugzilla.redhat.com/show_bug.cgi?id=2442343","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2770.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2770","description":"Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2764","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2764","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2764","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2764","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2764","date":"2026-11-12","epss":0.00737,"percentile":0.55008}],"risk":0.3685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2764"},"relatedVulnerabilities":[{"id":"CVE-2026-2764","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2764","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2764","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2764","date":"2026-11-12","epss":0.00737,"percentile":0.55008}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2012608","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2764","https://bugzilla.redhat.com/show_bug.cgi?id=2442329","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2764.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2764","description":"JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2766","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2766","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2766","date":"2026-11-12","epss":0.00737,"percentile":0.55008}],"risk":0.3685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2766"},"relatedVulnerabilities":[{"id":"CVE-2026-2766","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2766","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2766","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2766","date":"2026-11-12","epss":0.00737,"percentile":0.55008}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013583","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2766","https://bugzilla.redhat.com/show_bug.cgi?id=2442294","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2766.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2766","description":"Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2772","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2772","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2772","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2772","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2772","date":"2026-11-12","epss":0.00737,"percentile":0.55008}],"risk":0.3685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2772"},"relatedVulnerabilities":[{"id":"CVE-2026-2772","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2772","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2772","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2772","date":"2026-11-12","epss":0.00737,"percentile":0.55008}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014827","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2772","https://bugzilla.redhat.com/show_bug.cgi?id=2442326","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2772.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2772","description":"Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2765","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2765","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2765","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2765","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2765","date":"2026-11-12","epss":0.00737,"percentile":0.55007}],"risk":0.3685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2765"},"relatedVulnerabilities":[{"id":"CVE-2026-2765","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2765","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2765","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2765","date":"2026-11-12","epss":0.00737,"percentile":0.55007}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013562","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2765","https://bugzilla.redhat.com/show_bug.cgi?id=2442333","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2765.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2765","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0241","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0241","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0241","date":"2026-11-12","epss":0.00734,"percentile":0.54904}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0241"},"relatedVulnerabilities":[{"id":"CVE-2025-0241","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0241","cwe":"CWE-401","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0241","date":"2026-11-12","epss":0.00734,"percentile":0.54904}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1933023","https://www.mozilla.org/security/advisories/mfsa2025-01/","https://www.mozilla.org/security/advisories/mfsa2025-02/","https://www.mozilla.org/security/advisories/mfsa2025-04/","https://www.mozilla.org/security/advisories/mfsa2025-05/","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0241","description":"When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10463","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10463","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10463","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10463","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10463","date":"2026-11-12","epss":0.00734,"percentile":0.54903}],"risk":0.367,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10463"},"relatedVulnerabilities":[{"id":"CVE-2024-10463","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10463","cwe":"CWE-203","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10463","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10463","date":"2026-11-12","epss":0.00734,"percentile":0.54903}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1920800","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-57/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10463","description":"Video frames could have been leaked between origins in some situations. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112320","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112320","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"risk":0.3655,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112320"},"relatedVulnerabilities":[{"id":"CVE-2026-112320","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112320","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112320","date":"2026-11-12","epss":0.00731,"percentile":0.54789}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112320","https://bugzilla.redhat.com/show_bug.cgi?id=2478449"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112320","description":"The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4685","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4685","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4685","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4685","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4685","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4685","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"risk":0.365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4685"},"relatedVulnerabilities":[{"id":"CVE-2026-4685","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4685","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4685","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4685","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4685","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016349","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4685","https://bugzilla.redhat.com/show_bug.cgi?id=2450724","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4685.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4685","description":"Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4695","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4695","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4695","cwe":"CWE-131","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4695","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"risk":0.365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4695"},"relatedVulnerabilities":[{"id":"CVE-2026-4695","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4695","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4695","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4695","cwe":"CWE-131","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4695","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2020030","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4695","https://bugzilla.redhat.com/show_bug.cgi?id=2450715","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4695.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4695","description":"Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4697","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4697","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4697","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4697","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4697","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4697","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"risk":0.365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4697"},"relatedVulnerabilities":[{"id":"CVE-2026-4697","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4697","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4697","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4697","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4697","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2020422","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4697","https://bugzilla.redhat.com/show_bug.cgi?id=2450729","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4697.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4697","description":"Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4699","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4699","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4699","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4699","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4699","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"risk":0.365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4699"},"relatedVulnerabilities":[{"id":"CVE-2026-4699","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4699","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4699","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4699","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4699","date":"2026-11-12","epss":0.0073,"percentile":0.54766}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2021863","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4699","https://bugzilla.redhat.com/show_bug.cgi?id=2450739","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4699.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4699","description":"Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4693","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4693","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4693","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4693","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4693","cwe":"CWE-823","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4693","date":"2026-11-12","epss":0.0073,"percentile":0.54765}],"risk":0.365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4693"},"relatedVulnerabilities":[{"id":"CVE-2026-4693","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4693","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4693","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4693","cwe":"CWE-823","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4693","date":"2026-11-12","epss":0.0073,"percentile":0.54765}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2018102","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4693","https://bugzilla.redhat.com/show_bug.cgi?id=2450741","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4693.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4693","description":"Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11699","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11699","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11699","date":"2026-11-12","epss":0.00723,"percentile":0.54505}],"risk":0.36150000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11699"},"relatedVulnerabilities":[{"id":"CVE-2024-11699","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11699","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11699","date":"2026-11-12","epss":0.00723,"percentile":0.54505}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1880582%2C1929911","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-64/","https://www.mozilla.org/security/advisories/mfsa2024-67/","https://www.mozilla.org/security/advisories/mfsa2024-68/","https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11699","description":"Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8384","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8384","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8384","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8384","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8384","date":"2026-11-12","epss":0.00719,"percentile":0.5437}],"risk":0.3595,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8384"},"relatedVulnerabilities":[{"id":"CVE-2024-8384","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8384","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8384","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8384","date":"2026-11-12","epss":0.00719,"percentile":0.5437}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1911288","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-41/","https://www.mozilla.org/security/advisories/mfsa2024-43/","https://www.mozilla.org/security/advisories/mfsa2024-44/","https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8384","description":"The JavaScript garbage collector could mis-color cross-compartment objects if OOM conditions were detected at the right point between two passes. This could have led to memory corruption. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4702","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4702","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4702","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4702","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4702","date":"2026-11-12","epss":0.00716,"percentile":0.54239}],"risk":0.358,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4702"},"relatedVulnerabilities":[{"id":"CVE-2026-4702","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4702","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4702","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4702","date":"2026-11-12","epss":0.00716,"percentile":0.54239}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013560","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4702","description":"JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74945","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74945","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74945","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74945","date":"2026-11-12","epss":0.0071,"percentile":0.54024}],"risk":0.35500000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74945"},"relatedVulnerabilities":[{"id":"CVE-2026-74945","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74945","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74945","date":"2026-11-12","epss":0.0071,"percentile":0.54024}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2057808","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-75/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74945","description":"Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4689","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4689","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4689","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4689","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4689","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4689","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4689","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4689","date":"2026-11-12","epss":0.00706,"percentile":0.53876}],"risk":0.35300000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4689"},"relatedVulnerabilities":[{"id":"CVE-2026-4689","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4689","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4689","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4689","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4689","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4689","cwe":"CWE-190","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4689","date":"2026-11-12","epss":0.00706,"percentile":0.53876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016374","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4689","https://bugzilla.redhat.com/show_bug.cgi?id=2450718","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4689.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4689","description":"Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"risk":0.348,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112316"},"relatedVulnerabilities":[{"id":"CVE-2026-112316","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112316","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112316","date":"2026-11-12","epss":0.00696,"percentile":0.53489}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112316","https://bugzilla.redhat.com/show_bug.cgi?id=2479331"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112316","description":"xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2779","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2779","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2779","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2779","date":"2026-11-12","epss":0.00686,"percentile":0.53151}],"risk":0.34299999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2779"},"relatedVulnerabilities":[{"id":"CVE-2026-2779","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2779","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2779","date":"2026-11-12","epss":0.00686,"percentile":0.53151}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1164141","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2779","description":"Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2769","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2769","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2769","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2769","date":"2026-11-12","epss":0.00686,"percentile":0.53142}],"risk":0.34299999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2769"},"relatedVulnerabilities":[{"id":"CVE-2026-2769","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2769","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2769","date":"2026-11-12","epss":0.00686,"percentile":0.53142}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014550","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2769","https://bugzilla.redhat.com/show_bug.cgi?id=2442295","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2769.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2769","description":"Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2788","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2788","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2788","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2788","date":"2026-11-12","epss":0.00677,"percentile":0.52775}],"risk":0.3385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2788"},"relatedVulnerabilities":[{"id":"CVE-2026-2788","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2788","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2788","date":"2026-11-12","epss":0.00677,"percentile":0.52775}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014824","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2788","description":"Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0240","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0240","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0240","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0240","date":"2026-11-12","epss":0.00673,"percentile":0.52603}],"risk":0.3365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0240"},"relatedVulnerabilities":[{"id":"CVE-2025-0240","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0240","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0240","date":"2026-11-12","epss":0.00673,"percentile":0.52603}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1929623","https://www.mozilla.org/security/advisories/mfsa2025-01/","https://www.mozilla.org/security/advisories/mfsa2025-02/","https://www.mozilla.org/security/advisories/mfsa2025-04/","https://www.mozilla.org/security/advisories/mfsa2025-05/","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0240","description":"Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-49709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-49709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-49709","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-49709","date":"2026-11-12","epss":0.00671,"percentile":0.52525}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-49709"},"relatedVulnerabilities":[{"id":"CVE-2025-49709","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-49709","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-49709","date":"2026-11-12","epss":0.00671,"percentile":0.52525}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1966083","https://www.mozilla.org/security/advisories/mfsa2025-47/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-49709","description":"Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4705","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4705","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4705","cwe":"CWE-758","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4705","date":"2026-11-12","epss":0.00671,"percentile":0.52522}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4705"},"relatedVulnerabilities":[{"id":"CVE-2026-4705","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4705","cwe":"CWE-758","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4705","date":"2026-11-12","epss":0.00671,"percentile":0.52522}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014873","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4705","description":"Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4704","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4704","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4704","date":"2026-11-12","epss":0.00665,"percentile":0.52305}],"risk":0.33249999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4704"},"relatedVulnerabilities":[{"id":"CVE-2026-4704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4704","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4704","date":"2026-11-12","epss":0.00665,"percentile":0.52305}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014868","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4704","description":"Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112315"},"relatedVulnerabilities":[{"id":"CVE-2026-112315","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112315","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112315","date":"2026-11-12","epss":0.00661,"percentile":0.52143}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112315","https://bugzilla.redhat.com/show_bug.cgi?id=2479403"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112315","description":"The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11705","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11705","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11705","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11705","date":"2026-11-12","epss":0.0066,"percentile":0.52071}],"risk":0.33,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11705"},"relatedVulnerabilities":[{"id":"CVE-2024-11705","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11705","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11705","date":"2026-11-12","epss":0.0066,"percentile":0.52071}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1921768","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-67/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11705","description":"`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segmentation fault (SEGV) occurred, leading to crashes. This behavior conflicted with the PKCS#11 v3.0 specification, which allows `phKey` to be NULL for certain mechanisms. This vulnerability affects Firefox < 133 and Thunderbird < 133."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2805","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2805","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2805","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2805","date":"2026-11-12","epss":0.00657,"percentile":0.51973}],"risk":0.3285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2805"},"relatedVulnerabilities":[{"id":"CVE-2026-2805","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2805","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2805","date":"2026-11-12","epss":0.00657,"percentile":0.51973}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014549","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-16/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2805","description":"Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7652","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7652","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7652","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-7652","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7652","date":"2026-11-12","epss":0.00656,"percentile":0.519}],"risk":0.328,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7652"},"relatedVulnerabilities":[{"id":"CVE-2024-7652","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7652","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-7652","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7652","date":"2026-11-12","epss":0.00656,"percentile":0.519}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1901411","https://github.com/tc39/ecma262/security/advisories/GHSA-g38c-wh3c-5h9r","https://www.mozilla.org/security/advisories/mfsa2024-29/","https://www.mozilla.org/security/advisories/mfsa2024-30/","https://www.mozilla.org/security/advisories/mfsa2024-31/","https://www.mozilla.org/security/advisories/mfsa2024-32/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7652","description":"An error in the ECMA-262 specification relating to Async Generators could have resulted in a type confusion, potentially leading to memory corruption and an exploitable crash. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9179","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9179","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9179","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9179","date":"2026-11-12","epss":0.0065,"percentile":0.5167}],"risk":0.325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9179"},"relatedVulnerabilities":[{"id":"CVE-2025-9179","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9179","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9179","date":"2026-11-12","epss":0.0065,"percentile":0.5167}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1979527","https://www.mozilla.org/security/advisories/mfsa2025-64/","https://www.mozilla.org/security/advisories/mfsa2025-65/","https://www.mozilla.org/security/advisories/mfsa2025-66/","https://www.mozilla.org/security/advisories/mfsa2025-67/","https://www.mozilla.org/security/advisories/mfsa2025-70/","https://www.mozilla.org/security/advisories/mfsa2025-71/","https://www.mozilla.org/security/advisories/mfsa2025-72/","https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9179","description":"An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5283","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5283","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5283","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"},{"cve":"CVE-2025-5283","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-5283","date":"2026-11-12","epss":0.00642,"percentile":0.51307}],"risk":0.321,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5283"},"relatedVulnerabilities":[{"id":"CVE-2025-5283","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5283","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"},{"cve":"CVE-2025-5283","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-5283","date":"2026-11-12","epss":0.00642,"percentile":0.51307}],"urls":["https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_27.html","https://issues.chromium.org/issues/419467315","https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00052.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5283","description":"Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2787","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2787","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2787","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2787","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2787","date":"2026-11-12","epss":0.00641,"percentile":0.51255}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2787"},"relatedVulnerabilities":[{"id":"CVE-2026-2787","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2787","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2787","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2787","date":"2026-11-12","epss":0.00641,"percentile":0.51255}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014560","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2787","description":"Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10458","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10458","cwe":"CWE-281","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10458","date":"2026-11-12","epss":0.0064,"percentile":0.51153}],"risk":0.32,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10458"},"relatedVulnerabilities":[{"id":"CVE-2024-10458","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10458","cwe":"CWE-281","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10458","date":"2026-11-12","epss":0.0064,"percentile":0.51153}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1921733","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-57/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10458","description":"A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14321","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14321","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14321","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14321","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14321","date":"2026-11-12","epss":0.00639,"percentile":0.51129}],"risk":0.3195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14321"},"relatedVulnerabilities":[{"id":"CVE-2025-14321","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14321","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14321","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14321","date":"2026-11-12","epss":0.00639,"percentile":0.51129}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1992760","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14321","description":"Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112323","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112323"},"relatedVulnerabilities":[{"id":"CVE-2026-112323","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112323","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112323","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112323","https://bugzilla.redhat.com/show_bug.cgi?id=2478440"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112323","description":"The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-119079","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-119079"},"relatedVulnerabilities":[{"id":"CVE-2026-119079","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119079","cwe":"CWE-408","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-119079","date":"2026-11-12","epss":0.00638,"percentile":0.51075}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-119079","https://bugzilla.redhat.com/show_bug.cgi?id=2479231"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119079","description":"decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7520","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7520","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7520","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7520","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7520","date":"2026-11-12","epss":0.00638,"percentile":0.51072}],"risk":0.319,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7520"},"relatedVulnerabilities":[{"id":"CVE-2024-7520","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7520","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7520","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7520","date":"2026-11-12","epss":0.00638,"percentile":0.51072}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1903041","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7520","description":"A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10464","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10464","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10464","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10464","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10464","date":"2026-11-12","epss":0.00637,"percentile":0.51044}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10464"},"relatedVulnerabilities":[{"id":"CVE-2024-10464","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10464","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10464","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10464","date":"2026-11-12","epss":0.00637,"percentile":0.51044}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1913000","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10464","description":"Repeated writes to history interface attributes could have been used to cause a Denial of Service condition in the browser. This was addressed by introducing rate-limiting to this API. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8383","cwe":"CWE-1188","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8383","date":"2026-11-12","epss":0.00637,"percentile":0.51032}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8383"},"relatedVulnerabilities":[{"id":"CVE-2024-8383","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8383","cwe":"CWE-1188","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8383","date":"2026-11-12","epss":0.00637,"percentile":0.51032}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1908496","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-41/","https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8383","description":"Firefox normally asks for confirmation before asking the operating system to find an application to handle a scheme that the browser does not support. It did not ask before doing so for the Usenet-related schemes news: and snews:. Since most operating systems don't have a trusted newsreader installed by default, an unscrupulous program that the user downloaded could register itself as a handler. The website that served the application download could then launch that application at will. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Firefox ESR < 115.15."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16412","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16412","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16412","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16412","date":"2026-11-12","epss":0.00636,"percentile":0.51003}],"risk":0.318,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16412"},"relatedVulnerabilities":[{"id":"CVE-2026-16412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16412","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16412","date":"2026-11-12","epss":0.00636,"percentile":0.51003}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2005113%2C2025369%2C2026301%2C2028663%2C2029761%2C2042242%2C2043271%2C2043300%2C2044612%2C2045378%2C2045406%2C2045407%2C2045616%2C2045626%2C2045730%2C2045732%2C2045769%2C2045771%2C2047957%2C2048934%2C2049818%2C2049822%2C2050151%2C2050368%2C2051653%2C2051658","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043035%2C2045057%2C2045187%2C2045402%2C2045417%2C2045482%2C2045611%2C2045618%2C2045756%2C2046917%2C2047718","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045413%2C2053635%2C2053637","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16412","description":"Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7522","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7522","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7522","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7522","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7522","date":"2026-11-12","epss":0.00634,"percentile":0.50877}],"risk":0.317,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7522"},"relatedVulnerabilities":[{"id":"CVE-2024-7522","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7522","cwe":"CWE-125","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7522","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7522","date":"2026-11-12","epss":0.00634,"percentile":0.50877}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1906727","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7522","description":"Editor code failed to check an attribute value. This could have led to an out-of-bounds read. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10459","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10459","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10459","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10459","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10459","date":"2026-11-12","epss":0.00634,"percentile":0.50875}],"risk":0.317,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10459"},"relatedVulnerabilities":[{"id":"CVE-2024-10459","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10459","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10459","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10459","date":"2026-11-12","epss":0.00634,"percentile":0.50875}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1919087","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-57/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10459","description":"An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Firefox ESR < 115.17, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2762","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2762","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2762","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2762","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2762","date":"2026-11-12","epss":0.00632,"percentile":0.50805}],"risk":0.316,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2762"},"relatedVulnerabilities":[{"id":"CVE-2026-2762","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2762","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2762","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2762","date":"2026-11-12","epss":0.00632,"percentile":0.50805}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2011649","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2762","https://bugzilla.redhat.com/show_bug.cgi?id=2442308","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2762.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2762","description":"Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10467","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10467","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10467","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10467","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-10467","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10467","date":"2026-11-12","epss":0.00632,"percentile":0.50798}],"risk":0.316,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10467"},"relatedVulnerabilities":[{"id":"CVE-2024-10467","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10467","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10467","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2024-10467","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10467","date":"2026-11-12","epss":0.00632,"percentile":0.50798}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1829029%2C1888538%2C1900394%2C1904059%2C1917742%2C1919809%2C1923706","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10467","description":"Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4723","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4723","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4723","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4723","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4723","date":"2026-11-12","epss":0.00631,"percentile":0.50754}],"risk":0.3155,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4723"},"relatedVulnerabilities":[{"id":"CVE-2026-4723","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4723","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4723","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4723","date":"2026-11-12","epss":0.00631,"percentile":0.50754}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013573","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-23/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4723","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7519","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7519","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7519","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7519","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7519","date":"2026-11-12","epss":0.00629,"percentile":0.5067}],"risk":0.3145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7519"},"relatedVulnerabilities":[{"id":"CVE-2024-7519","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7519","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7519","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7519","date":"2026-11-12","epss":0.00629,"percentile":0.5067}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1902307","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7519","description":"Insufficient checks when processing graphics shared memory could have led to memory corruption. This could be leveraged by an attacker to perform a sandbox escape. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1011","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1011","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1011","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1011","date":"2026-11-12","epss":0.00629,"percentile":0.50661}],"risk":0.3145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1011"},"relatedVulnerabilities":[{"id":"CVE-2025-1011","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1011","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1011","date":"2026-11-12","epss":0.00629,"percentile":0.50661}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1936454","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1011","description":"A bug in WebAssembly code generation could have lead to a crash. It may have been possible for an attacker to leverage this to achieve code execution. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92240","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92240","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92240","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92240","date":"2026-11-12","epss":0.00628,"percentile":0.50628}],"risk":0.314,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92240"},"relatedVulnerabilities":[{"id":"CVE-2026-92240","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92240","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92240","date":"2026-11-12","epss":0.00628,"percentile":0.50628}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2069113","https://www.mozilla.org/security/advisories/mfsa2026-94/","https://www.mozilla.org/security/advisories/mfsa2026-95/","https://www.mozilla.org/security/advisories/mfsa2026-96/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92240","description":"A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16395","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16395","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16395","date":"2026-11-12","epss":0.00619,"percentile":0.5019}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16395"},"relatedVulnerabilities":[{"id":"CVE-2026-16395","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16395","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16395","date":"2026-11-12","epss":0.00619,"percentile":0.5019}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2047221","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16395","description":"Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16408","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16408","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16408","date":"2026-11-12","epss":0.00619,"percentile":0.5019}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16408"},"relatedVulnerabilities":[{"id":"CVE-2026-16408","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16408","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16408","date":"2026-11-12","epss":0.00619,"percentile":0.5019}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2050477","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16408","description":"Integer overflow in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16402","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16402","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16402","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16402","date":"2026-11-12","epss":0.00619,"percentile":0.50189}],"risk":0.3095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16402"},"relatedVulnerabilities":[{"id":"CVE-2026-16402","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16402","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16402","date":"2026-11-12","epss":0.00619,"percentile":0.50189}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2052703","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16402","description":"Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7521","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7521","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7521","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7521","cwe":"CWE-755","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7521","date":"2026-11-12","epss":0.00616,"percentile":0.50019}],"risk":0.308,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7521"},"relatedVulnerabilities":[{"id":"CVE-2024-7521","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7521","cwe":"CWE-755","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7521","cwe":"CWE-755","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7521","date":"2026-11-12","epss":0.00616,"percentile":0.50019}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1904644","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7521","description":"Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9402","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9402","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9402","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9402","date":"2026-11-12","epss":0.00615,"percentile":0.4999}],"risk":0.3075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9402"},"relatedVulnerabilities":[{"id":"CVE-2024-9402","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9402","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9402","date":"2026-11-12","epss":0.00615,"percentile":0.4999}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1872744%2C1897792%2C1911317%2C1913445%2C1914106%2C1914475%2C1914963%2C1915008%2C1916476","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9402","description":"Memory safety bugs present in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4707","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4707","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4707","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4707","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4707","date":"2026-11-12","epss":0.00613,"percentile":0.49881}],"risk":0.3065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4707"},"relatedVulnerabilities":[{"id":"CVE-2026-4707","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4707","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4707","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4707","date":"2026-11-12","epss":0.00613,"percentile":0.49881}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015267","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4707","description":"Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74988","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74988","date":"2026-11-12","epss":0.00609,"percentile":0.49652}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74988"},"relatedVulnerabilities":[{"id":"CVE-2026-74988","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74988","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74988","date":"2026-11-12","epss":0.00609,"percentile":0.49652}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2018164%2C2045404%2C2045507%2C2045711%2C2052403%2C2053174%2C2054643%2C2054667%2C2054671%2C2054674%2C2054687%2C2054717%2C2054761%2C2054787%2C2055676%2C2056779%2C2056781%2C2058629%2C2059019%2C2059138","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045796%2C2046734%2C2051424%2C2054721%2C2057994%2C2058094%2C2058611%2C2058615%2C2058616%2C2061315","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2053153%2C2053262%2C2054763%2C2059198%2C2059224","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74988","description":"Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7527","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7527","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7527","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7527","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7527","date":"2026-11-12","epss":0.00607,"percentile":0.49535}],"risk":0.3035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7527"},"relatedVulnerabilities":[{"id":"CVE-2024-7527","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7527","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7527","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7527","date":"2026-11-12","epss":0.00607,"percentile":0.49535}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1871303","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7527","description":"Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8956","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8956","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8956","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8956","date":"2026-11-12","epss":0.00605,"percentile":0.49467}],"risk":0.3025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8956"},"relatedVulnerabilities":[{"id":"CVE-2026-8956","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8956","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8956","date":"2026-11-12","epss":0.00605,"percentile":0.49467}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2032427","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8956","description":"Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14324","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14324","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14324","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14324","date":"2026-11-12","epss":0.00605,"percentile":0.49464}],"risk":0.3025,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14324"},"relatedVulnerabilities":[{"id":"CVE-2025-14324","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14324","cwe":"CWE-94","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14324","date":"2026-11-12","epss":0.00605,"percentile":0.49464}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1996840","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-93/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14324","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74977","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74977","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74977","date":"2026-11-12","epss":0.006,"percentile":0.49246}],"risk":0.3,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74977"},"relatedVulnerabilities":[{"id":"CVE-2026-74977","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74977","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74977","date":"2026-11-12","epss":0.006,"percentile":0.49246}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2028440","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74977","description":"Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10461","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10461","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10461","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10461","date":"2026-11-12","epss":0.00599,"percentile":0.49171}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10461"},"relatedVulnerabilities":[{"id":"CVE-2024-10461","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10461","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10461","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10461","date":"2026-11-12","epss":0.00599,"percentile":0.49171}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1914521","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10461","description":"In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2791","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2791","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2791","date":"2026-11-12","epss":0.00599,"percentile":0.49158}],"risk":0.2995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2791"},"relatedVulnerabilities":[{"id":"CVE-2026-2791","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2791","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2791","date":"2026-11-12","epss":0.00599,"percentile":0.49158}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015220","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2791","description":"Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7525","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7525","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7525","cwe":"CWE-276","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7525","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7525","date":"2026-11-12","epss":0.00598,"percentile":0.49134}],"risk":0.299,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7525"},"relatedVulnerabilities":[{"id":"CVE-2024-7525","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7525","cwe":"CWE-276","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7525","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7525","date":"2026-11-12","epss":0.00598,"percentile":0.49134}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1909298","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7525","description":"It was possible for a web extension with minimal permissions to create a `StreamFilter` which could be used to read and modify the response body of requests on any site. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-0237","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-0237","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-0237","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0237","date":"2026-11-12","epss":0.00598,"percentile":0.49115}],"risk":0.299,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-0237"},"relatedVulnerabilities":[{"id":"CVE-2025-0237","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-0237","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-0237","date":"2026-11-12","epss":0.00598,"percentile":0.49115}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1915257","https://www.mozilla.org/security/advisories/mfsa2025-01/","https://www.mozilla.org/security/advisories/mfsa2025-02/","https://www.mozilla.org/security/advisories/mfsa2025-04/","https://www.mozilla.org/security/advisories/mfsa2025-05/","https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-0237","description":"The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal being sent. This could have led to privilege escalation attacks. This vulnerability was fixed in Firefox 134, Firefox ESR 128.6, Thunderbird 134, and Thunderbird 128.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8382","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8382","cwe":"CWE-273","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8382","date":"2026-11-12","epss":0.00595,"percentile":0.48934}],"risk":0.29750000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8382"},"relatedVulnerabilities":[{"id":"CVE-2024-8382","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8382","cwe":"CWE-273","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8382","date":"2026-11-12","epss":0.00595,"percentile":0.48934}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1906744","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-41/","https://www.mozilla.org/security/advisories/mfsa2024-43/","https://www.mozilla.org/security/advisories/mfsa2024-44/","https://lists.debian.org/debian-lts-announce/2024/09/msg00012.html","https://lists.debian.org/debian-lts-announce/2024/09/msg00025.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8382","description":"Internal browser event interfaces were exposed to web content when privileged EventHandler listener callbacks ran for those events. Web content that tried to use those interfaces would not be able to use them with elevated privileges, but their presence would indicate certain browser features had been used, such as when a user opened the Dev Tools console. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, Firefox ESR < 115.15, Thunderbird < 128.2, and Thunderbird < 115.15."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74964","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74964","date":"2026-11-12","epss":0.00595,"percentile":0.48922}],"risk":0.29750000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74964"},"relatedVulnerabilities":[{"id":"CVE-2026-74964","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74964","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74964","date":"2026-11-12","epss":0.00595,"percentile":0.48922}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2053327","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74964","description":"Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2757","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2757","cwe":"CWE-1384","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2757","date":"2026-11-12","epss":0.00589,"percentile":0.4867}],"risk":0.29450000000000004,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2757"},"relatedVulnerabilities":[{"id":"CVE-2026-2757","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.1,"impactScore":5.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2757","cwe":"CWE-1384","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2757","date":"2026-11-12","epss":0.00589,"percentile":0.4867}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2001637","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2757","https://bugzilla.redhat.com/show_bug.cgi?id=2442324","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2757.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2757","description":"Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1016","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1016","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1016","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1016","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1016","date":"2026-11-12","epss":0.00588,"percentile":0.4861}],"risk":0.294,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1016"},"relatedVulnerabilities":[{"id":"CVE-2025-1016","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1016","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1016","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1016","date":"2026-11-12","epss":0.00588,"percentile":0.4861}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1936601%2C1936844%2C1937694%2C1938469%2C1939583%2C1940994","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-08/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1016","description":"Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9396","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9396","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9396","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9396","date":"2026-11-12","epss":0.00587,"percentile":0.48536}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9396"},"relatedVulnerabilities":[{"id":"CVE-2024-9396","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9396","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9396","date":"2026-11-12","epss":0.00587,"percentile":0.48536}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1912471","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9396","description":"It is currently unknown if this issue is exploitable but a condition may arise where the structured clone of certain objects could lead to memory corruption. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8387","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8387","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8387","date":"2026-11-12","epss":0.00584,"percentile":0.4842}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8387"},"relatedVulnerabilities":[{"id":"CVE-2024-8387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8387","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8387","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8387","date":"2026-11-12","epss":0.00584,"percentile":0.4842}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1857607%2C1911858%2C1914009","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-43/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8387","description":"Memory safety bugs present in Firefox 129, Firefox ESR 128.1, and Thunderbird 128.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8949","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8949","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8949","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8949","date":"2026-11-12","epss":0.00583,"percentile":0.48372}],"risk":0.2915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8949"},"relatedVulnerabilities":[{"id":"CVE-2026-8949","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8949","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8949","date":"2026-11-12","epss":0.00583,"percentile":0.48372}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1355639","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8949","description":"Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7526","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7526","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7526","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7526","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7526","date":"2026-11-12","epss":0.0058,"percentile":0.4821}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7526"},"relatedVulnerabilities":[{"id":"CVE-2024-7526","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7526","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7526","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7526","date":"2026-11-12","epss":0.0058,"percentile":0.4821}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1910306","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7526","description":"ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8028","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8028","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8028","cwe":"CWE-1332","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8028","date":"2026-11-12","epss":0.0058,"percentile":0.48195}],"risk":0.29,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8028"},"relatedVulnerabilities":[{"id":"CVE-2025-8028","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8028","cwe":"CWE-1332","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8028","date":"2026-11-12","epss":0.0058,"percentile":0.48195}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1971581","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-57/","https://www.mozilla.org/security/advisories/mfsa2025-58/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-62/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8028","description":"On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction causing truncation and incorrect computation of the branch address. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112317","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112317","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"risk":0.2885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112317"},"relatedVulnerabilities":[{"id":"CVE-2026-112317","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112317","cwe":"CWE-772","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112317","date":"2026-11-12","epss":0.00577,"percentile":0.48064}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112317","https://bugzilla.redhat.com/show_bug.cgi?id=2479209"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112317","description":"krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2785","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2785","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2785","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2785","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2785","date":"2026-11-12","epss":0.00576,"percentile":0.47995}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2785"},"relatedVulnerabilities":[{"id":"CVE-2026-2785","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2785","cwe":"CWE-824","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2785","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2785","date":"2026-11-12","epss":0.00576,"percentile":0.47995}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013549","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2785","description":"Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8385","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8385","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8385","date":"2026-11-12","epss":0.00575,"percentile":0.47958}],"risk":0.2875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8385"},"relatedVulnerabilities":[{"id":"CVE-2024-8385","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8385","cwe":"CWE-843","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8385","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8385","date":"2026-11-12","epss":0.00575,"percentile":0.47958}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1911909","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-43/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8385","description":"A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1017","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1017","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1017","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1017","date":"2026-11-12","epss":0.00575,"percentile":0.47942}],"risk":0.2875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1017"},"relatedVulnerabilities":[{"id":"CVE-2025-1017","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1017","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1017","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1017","date":"2026-11-12","epss":0.00575,"percentile":0.47942}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1926256%2C1935984%2C1935471","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1017","description":"Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2758","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2758","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2758","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2758","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2758","date":"2026-11-12","epss":0.00573,"percentile":0.47826}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2758"},"relatedVulnerabilities":[{"id":"CVE-2026-2758","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2758","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2758","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2758","date":"2026-11-12","epss":0.00573,"percentile":0.47826}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2009608","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2758","https://bugzilla.redhat.com/show_bug.cgi?id=2442337","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2758.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2758","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4687","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4687","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4687","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4687","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4687","cwe":"CWE-501","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4687","date":"2026-11-12","epss":0.00572,"percentile":0.47787}],"risk":0.28600000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4687"},"relatedVulnerabilities":[{"id":"CVE-2026-4687","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H","metrics":{"baseScore":8.6,"impactScore":4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4687","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4687","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4687","cwe":"CWE-501","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4687","date":"2026-11-12","epss":0.00572,"percentile":0.47787}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016368","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4687","https://bugzilla.redhat.com/show_bug.cgi?id=2450757","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4687.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4687","description":"Sandbox escape due to incorrect boundary conditions in the Telemetry component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74989","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74989","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74989","date":"2026-11-12","epss":0.0057,"percentile":0.47661}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74989"},"relatedVulnerabilities":[{"id":"CVE-2026-74989","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74989","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74989","date":"2026-11-12","epss":0.0057,"percentile":0.47661}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022257%2C2027351%2C2027380%2C2029289","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027388%2C2029750%2C2029794%2C2043298%2C2045126%2C2049810%2C2051741","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-78/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74989","description":"Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84134","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84134","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84134","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84134","date":"2026-11-12","epss":0.0057,"percentile":0.47661}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84134"},"relatedVulnerabilities":[{"id":"CVE-2026-84134","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84134","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84134","date":"2026-11-12","epss":0.0057,"percentile":0.47661}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2044882","https://www.mozilla.org/security/advisories/mfsa2026-82/","https://www.mozilla.org/security/advisories/mfsa2026-85/","https://www.mozilla.org/security/advisories/mfsa2026-86/","https://www.mozilla.org/security/advisories/mfsa2026-88/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84134","description":"Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-112318","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-112318","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-112318"},"relatedVulnerabilities":[{"id":"CVE-2026-112318","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-112318","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-112318","date":"2026-11-12","epss":0.0057,"percentile":0.47658}],"urls":["https://access.redhat.com/errata/RHSA-2026:99624","https://access.redhat.com/errata/RHSA-2026:99625","https://access.redhat.com/errata/RHSA-2026:99715","https://access.redhat.com/errata/RHSA-2026:99716","https://access.redhat.com/security/cve/CVE-2026-112318","https://bugzilla.redhat.com/show_bug.cgi?id=2478792"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-112318","description":"The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9398","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9398","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9398","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9398","date":"2026-11-12","epss":0.00566,"percentile":0.47466}],"risk":0.28300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9398"},"relatedVulnerabilities":[{"id":"CVE-2024-9398","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9398","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9398","date":"2026-11-12","epss":0.00566,"percentile":0.47466}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1881037","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9398","description":"By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10462","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10462","cwe":"CWE-290","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10462","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10462","date":"2026-11-12","epss":0.00565,"percentile":0.47453}],"risk":0.2825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10462"},"relatedVulnerabilities":[{"id":"CVE-2024-10462","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10462","cwe":"CWE-290","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10462","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10462","date":"2026-11-12","epss":0.00565,"percentile":0.47453}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1920423","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10462","description":"Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10465","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10465","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10465","cwe":"CWE-290","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10465","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10465","date":"2026-11-12","epss":0.00565,"percentile":0.47453}],"risk":0.2825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10465"},"relatedVulnerabilities":[{"id":"CVE-2024-10465","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10465","cwe":"CWE-290","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10465","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10465","date":"2026-11-12","epss":0.00565,"percentile":0.47453}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1918853","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-56/","https://www.mozilla.org/security/advisories/mfsa2024-58/","https://www.mozilla.org/security/advisories/mfsa2024-59/","https://lists.debian.org/debian-lts-announce/2024/10/msg00034.html","https://lists.debian.org/debian-lts-announce/2024/11/msg00001.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10465","description":"A clipboard \"paste\" button could persist across tabs which allowed a spoofing attack. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16389","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16389","date":"2026-11-12","epss":0.00565,"percentile":0.4743}],"risk":0.2825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16389"},"relatedVulnerabilities":[{"id":"CVE-2026-16389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16389","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16389","date":"2026-11-12","epss":0.00565,"percentile":0.4743}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2043887","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://lists.debian.org/debian-lts-announce/2026/08/msg00019.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16389","description":"Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4688","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4688","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4688","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4688","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4688","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4688","date":"2026-11-12","epss":0.00564,"percentile":0.47371}],"risk":0.28200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4688"},"relatedVulnerabilities":[{"id":"CVE-2026-4688","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4688","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4688","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4688","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4688","date":"2026-11-12","epss":0.00564,"percentile":0.47371}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016373","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4688","https://bugzilla.redhat.com/show_bug.cgi?id=2450713","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4688.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4688","description":"Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4726","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4726","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4726","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4726","date":"2026-11-12","epss":0.00563,"percentile":0.47302}],"risk":0.2815,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4726"},"relatedVulnerabilities":[{"id":"CVE-2026-4726","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4726","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4726","date":"2026-11-12","epss":0.00563,"percentile":0.47302}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1955311","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4726","description":"Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4727","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4727","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4727","date":"2026-11-12","epss":0.00563,"percentile":0.47302}],"risk":0.2815,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4727"},"relatedVulnerabilities":[{"id":"CVE-2026-4727","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4727","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4727","date":"2026-11-12","epss":0.00563,"percentile":0.47302}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2008112","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4727","description":"Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2776","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2776","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2776","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2776","date":"2026-11-12","epss":0.00562,"percentile":0.47292}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2776"},"relatedVulnerabilities":[{"id":"CVE-2026-2776","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2776","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2776","date":"2026-11-12","epss":0.00562,"percentile":0.47292}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015266","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2776","https://bugzilla.redhat.com/show_bug.cgi?id=2442291","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2776.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2776","description":"Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2778","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2778","date":"2026-11-12","epss":0.00562,"percentile":0.47292}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2778"},"relatedVulnerabilities":[{"id":"CVE-2026-2778","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2778","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2778","date":"2026-11-12","epss":0.00562,"percentile":0.47292}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016358","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2778","https://bugzilla.redhat.com/show_bug.cgi?id=2442335","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2778.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2778","description":"Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1937","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1937","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1937","cwe":"CWE-1260","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1937","date":"2026-11-12","epss":0.00562,"percentile":0.4722}],"risk":0.281,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1937"},"relatedVulnerabilities":[{"id":"CVE-2025-1937","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1937","cwe":"CWE-1260","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1937","date":"2026-11-12","epss":0.00562,"percentile":0.4722}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1938471%2C1940716","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-15/","https://www.mozilla.org/security/advisories/mfsa2025-16/","https://www.mozilla.org/security/advisories/mfsa2025-17/","https://www.mozilla.org/security/advisories/mfsa2025-18/","http://www.openwall.com/lists/oss-security/2025/03/10/6","https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1937","description":"Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84142","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84142","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84142","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-84142","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84142","date":"2026-11-12","epss":0.00561,"percentile":0.47149}],"risk":0.2805,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84142"},"relatedVulnerabilities":[{"id":"CVE-2026-84142","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84142","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-84142","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84142","date":"2026-11-12","epss":0.00561,"percentile":0.47149}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029421%2C2040889%2C2045313%2C2045435%2C2053578%2C2058621%2C2058626","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2048796%2C2053150%2C2057356","https://www.mozilla.org/security/advisories/mfsa2026-82/","https://www.mozilla.org/security/advisories/mfsa2026-86/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84142","description":"Internally found bugs present in Thunderbird 154. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155 and Thunderbird 155."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8946","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8946","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8946","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8946","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8946","date":"2026-11-12","epss":0.0056,"percentile":0.47085}],"risk":0.27999999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8946"},"relatedVulnerabilities":[{"id":"CVE-2026-8946","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8946","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8946","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8946","date":"2026-11-12","epss":0.0056,"percentile":0.47085}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2029070","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-47/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/","https://access.redhat.com/errata/RHSA-2026:21378","https://access.redhat.com/errata/RHSA-2026:21380","https://access.redhat.com/errata/RHSA-2026:21381","https://access.redhat.com/errata/RHSA-2026:21382","https://access.redhat.com/errata/RHSA-2026:22325","https://access.redhat.com/errata/RHSA-2026:22643","https://access.redhat.com/errata/RHSA-2026:26174","https://access.redhat.com/errata/RHSA-2026:26268","https://access.redhat.com/errata/RHSA-2026:26269","https://access.redhat.com/errata/RHSA-2026:26270","https://access.redhat.com/errata/RHSA-2026:26491","https://access.redhat.com/errata/RHSA-2026:26492","https://access.redhat.com/errata/RHSA-2026:26493","https://access.redhat.com/errata/RHSA-2026:26521","https://access.redhat.com/errata/RHSA-2026:26536","https://access.redhat.com/errata/RHSA-2026:26539","https://access.redhat.com/errata/RHSA-2026:26551","https://access.redhat.com/errata/RHSA-2026:26606","https://access.redhat.com/errata/RHSA-2026:26629","https://access.redhat.com/errata/RHSA-2026:26630","https://access.redhat.com/errata/RHSA-2026:27715","https://access.redhat.com/security/cve/CVE-2026-8946","https://bugzilla.redhat.com/show_bug.cgi?id=2479849","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8946.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8946","description":"Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16382","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16382","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16382","date":"2026-11-12","epss":0.00556,"percentile":0.46845}],"risk":0.27799999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16382"},"relatedVulnerabilities":[{"id":"CVE-2026-16382","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16382","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16382","date":"2026-11-12","epss":0.00556,"percentile":0.46845}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041864","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16382","description":"Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74986","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74986","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74986","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74986","date":"2026-11-12","epss":0.00555,"percentile":0.46779}],"risk":0.2775,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74986"},"relatedVulnerabilities":[{"id":"CVE-2026-74986","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74986","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74986","date":"2026-11-12","epss":0.00555,"percentile":0.46779}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2060048","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74986","description":"Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92036","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92036","date":"2026-11-12","epss":0.00551,"percentile":0.46582}],"risk":0.2755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92036"},"relatedVulnerabilities":[{"id":"CVE-2026-92036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92036","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92036","date":"2026-11-12","epss":0.00551,"percentile":0.46582}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2068416","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92036","description":"Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92061","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92061","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92061","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92061","date":"2026-11-12","epss":0.00551,"percentile":0.46582}],"risk":0.2755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92061"},"relatedVulnerabilities":[{"id":"CVE-2026-92061","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92061","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92061","date":"2026-11-12","epss":0.00551,"percentile":0.46582}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041758","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92061","description":"Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16388","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16388","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"risk":0.2755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16388"},"relatedVulnerabilities":[{"id":"CVE-2026-16388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16388","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16388","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2043845","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16388","description":"Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16410","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16410","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16410","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16410","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"risk":0.2755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16410"},"relatedVulnerabilities":[{"id":"CVE-2026-16410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16410","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16410","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2053680","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16410","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92037","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92037","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92037","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92037","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"risk":0.2755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92037"},"relatedVulnerabilities":[{"id":"CVE-2026-92037","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92037","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92037","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2068460","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92037","description":"Incorrect boundary conditions in the DOM: Animation component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92066","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92066","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92066","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92066","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"risk":0.2755,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92066"},"relatedVulnerabilities":[{"id":"CVE-2026-92066","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92066","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92066","date":"2026-11-12","epss":0.00551,"percentile":0.46581}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2058093","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92066","description":"Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0880","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0880","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0880","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0880","date":"2026-11-12","epss":0.00543,"percentile":0.46108}],"risk":0.2715,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0880"},"relatedVulnerabilities":[{"id":"CVE-2026-0880","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0880","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0880","date":"2026-11-12","epss":0.00543,"percentile":0.46108}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2005014","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-02/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/","https://access.redhat.com/errata/RHSA-2026:0667","https://access.redhat.com/errata/RHSA-2026:0694","https://access.redhat.com/errata/RHSA-2026:0924","https://access.redhat.com/errata/RHSA-2026:1320","https://access.redhat.com/errata/RHSA-2026:1413","https://access.redhat.com/errata/RHSA-2026:1414","https://access.redhat.com/errata/RHSA-2026:1415","https://access.redhat.com/errata/RHSA-2026:1461","https://access.redhat.com/errata/RHSA-2026:1462","https://access.redhat.com/errata/RHSA-2026:1471","https://access.redhat.com/errata/RHSA-2026:1487","https://access.redhat.com/errata/RHSA-2026:2041","https://access.redhat.com/errata/RHSA-2026:2043","https://access.redhat.com/errata/RHSA-2026:2044","https://access.redhat.com/errata/RHSA-2026:2047","https://access.redhat.com/errata/RHSA-2026:2069","https://access.redhat.com/errata/RHSA-2026:2070","https://access.redhat.com/errata/RHSA-2026:2073","https://access.redhat.com/errata/RHSA-2026:2074","https://access.redhat.com/errata/RHSA-2026:2220","https://access.redhat.com/errata/RHSA-2026:2231","https://access.redhat.com/errata/RHSA-2026:2271","https://access.redhat.com/errata/RHSA-2026:2286","https://access.redhat.com/security/cve/CVE-2026-0880","https://bugzilla.redhat.com/show_bug.cgi?id=2428975","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0880.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0880","description":"Sandbox escape due to integer overflow in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14330","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14330","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14330","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-14330","cwe":"CWE-686","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-14330","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14330","date":"2026-11-12","epss":0.00542,"percentile":0.4608}],"risk":0.271,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14330"},"relatedVulnerabilities":[{"id":"CVE-2025-14330","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14330","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-14330","cwe":"CWE-686","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2025-14330","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14330","date":"2026-11-12","epss":0.00542,"percentile":0.4608}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1997503","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14330","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1020","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1020","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1020","date":"2026-11-12","epss":0.00541,"percentile":0.45958}],"risk":0.2705,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1020"},"relatedVulnerabilities":[{"id":"CVE-2025-1020","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1020","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1020","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1020","date":"2026-11-12","epss":0.00541,"percentile":0.45958}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1939063%2C1942169","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-11/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1020","description":"Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135 and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9185","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9185","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9185","date":"2026-11-12","epss":0.0054,"percentile":0.45918}],"risk":0.27,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9185"},"relatedVulnerabilities":[{"id":"CVE-2025-9185","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9185","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9185","date":"2026-11-12","epss":0.0054,"percentile":0.45918}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1970154%2C1976782%2C1977166","https://www.mozilla.org/security/advisories/mfsa2025-64/","https://www.mozilla.org/security/advisories/mfsa2025-65/","https://www.mozilla.org/security/advisories/mfsa2025-66/","https://www.mozilla.org/security/advisories/mfsa2025-67/","https://www.mozilla.org/security/advisories/mfsa2025-70/","https://www.mozilla.org/security/advisories/mfsa2025-71/","https://www.mozilla.org/security/advisories/mfsa2025-72/","https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9185","description":"Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92238","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92238","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92238","date":"2026-11-12","epss":0.00539,"percentile":0.45846}],"risk":0.2695,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92238"},"relatedVulnerabilities":[{"id":"CVE-2026-92238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92238","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92238","date":"2026-11-12","epss":0.00539,"percentile":0.45846}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2060601","https://www.mozilla.org/security/advisories/mfsa2026-94/","https://www.mozilla.org/security/advisories/mfsa2026-95/","https://www.mozilla.org/security/advisories/mfsa2026-96/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92238","description":"A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1931","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1931","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1931","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1931","date":"2026-11-12","epss":0.00538,"percentile":0.45826}],"risk":0.269,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1931"},"relatedVulnerabilities":[{"id":"CVE-2025-1931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1931","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1931","date":"2026-11-12","epss":0.00538,"percentile":0.45826}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1944126","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-15/","https://www.mozilla.org/security/advisories/mfsa2025-16/","https://www.mozilla.org/security/advisories/mfsa2025-17/","https://www.mozilla.org/security/advisories/mfsa2025-18/","https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1931","description":"It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2799","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2799","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2799","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2799","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2799","date":"2026-11-12","epss":0.00537,"percentile":0.45723}],"risk":0.26849999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2799"},"relatedVulnerabilities":[{"id":"CVE-2026-2799","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2799","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2799","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2799","date":"2026-11-12","epss":0.00537,"percentile":0.45723}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014551","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://access.redhat.com/security/cve/CVE-2026-2799","https://bugzilla.redhat.com/show_bug.cgi?id=2442303","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2799.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2799","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16393","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16393","date":"2026-11-12","epss":0.00536,"percentile":0.45716}],"risk":0.268,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16393"},"relatedVulnerabilities":[{"id":"CVE-2026-16393","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16393","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16393","date":"2026-11-12","epss":0.00536,"percentile":0.45716}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2045410","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16393","description":"Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9392","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9392","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9392","cwe":"CWE-346","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9392","date":"2026-11-12","epss":0.00535,"percentile":0.45637}],"risk":0.26749999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9392"},"relatedVulnerabilities":[{"id":"CVE-2024-9392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9392","cwe":"CWE-346","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9392","date":"2026-11-12","epss":0.00535,"percentile":0.45637}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1899154","https://bugzilla.mozilla.org/show_bug.cgi?id=1905843","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-48/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/","https://lists.debian.org/debian-lts-announce/2024/10/msg00004.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9392","description":"A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74982","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74982","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74982","date":"2026-11-12","epss":0.00534,"percentile":0.45593}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74982"},"relatedVulnerabilities":[{"id":"CVE-2026-74982","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74982","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74982","date":"2026-11-12","epss":0.00534,"percentile":0.45593}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2051788","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74982","description":"Denial-of-service in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74990","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74990","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74990","date":"2026-11-12","epss":0.00534,"percentile":0.45557}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74990"},"relatedVulnerabilities":[{"id":"CVE-2026-74990","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74990","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74990","date":"2026-11-12","epss":0.00534,"percentile":0.45557}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045762%2C2052401%2C2058208","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2045774%2C2048490%2C2050864%2C2053159%2C2053260%2C2053261%2C2053582%2C2053599%2C2053607%2C2053608%2C2053853%2C2054626%2C2054627%2C2054635%2C2054677%2C2054740%2C2054832%2C2056792%2C2057098%2C2057100%2C2057101%2C2057103%2C2057117%2C2057118%2C2058048%2C2058049%2C2058622%2C2058623%2C2058665%2C2058666%2C2059121%2C2059164%2C2059188","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-75/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74990","description":"Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8953","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8953","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8953","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8953","date":"2026-11-12","epss":0.00532,"percentile":0.45483}],"risk":0.266,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8953"},"relatedVulnerabilities":[{"id":"CVE-2026-8953","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8953","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8953","date":"2026-11-12","epss":0.00532,"percentile":0.45483}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2029511","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-47/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8953","description":"Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16392","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16392","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16392","cwe":"CWE-670","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16392","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16392","date":"2026-11-12","epss":0.00531,"percentile":0.45393}],"risk":0.26549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16392"},"relatedVulnerabilities":[{"id":"CVE-2026-16392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16392","cwe":"CWE-670","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16392","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16392","date":"2026-11-12","epss":0.00531,"percentile":0.45393}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2044606","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16392","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92051","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92051","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92051","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92051","date":"2026-11-12","epss":0.00531,"percentile":0.45393}],"risk":0.26549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92051"},"relatedVulnerabilities":[{"id":"CVE-2026-92051","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92051","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92051","date":"2026-11-12","epss":0.00531,"percentile":0.45393}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2061393","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92051","description":"Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2789","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2789","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2789","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2789","date":"2026-11-12","epss":0.0053,"percentile":0.45353}],"risk":0.265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2789"},"relatedVulnerabilities":[{"id":"CVE-2026-2789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2789","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2789","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2789","date":"2026-11-12","epss":0.0053,"percentile":0.45353}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015179","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2789","description":"Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117862","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117862","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117862","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117862","date":"2026-11-12","epss":0.00528,"percentile":0.45172}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117862"},"relatedVulnerabilities":[{"id":"CVE-2026-117862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117862","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117862","date":"2026-11-12","epss":0.00528,"percentile":0.45172}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2054644","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117862","description":"Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117917","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117917","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117917","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117917","date":"2026-11-12","epss":0.00528,"percentile":0.45172}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117917"},"relatedVulnerabilities":[{"id":"CVE-2026-117917","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117917","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117917","date":"2026-11-12","epss":0.00528,"percentile":0.45172}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079301","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117917","description":"Invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117946","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117946","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117946","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117946","date":"2026-11-12","epss":0.00528,"percentile":0.45172}],"risk":0.264,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117946"},"relatedVulnerabilities":[{"id":"CVE-2026-117946","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117946","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117946","date":"2026-11-12","epss":0.00528,"percentile":0.45172}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082092","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117946","description":"Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74985","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74985","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74985","date":"2026-11-12","epss":0.00527,"percentile":0.45118}],"risk":0.2635,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74985"},"relatedVulnerabilities":[{"id":"CVE-2026-74985","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74985","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74985","date":"2026-11-12","epss":0.00527,"percentile":0.45118}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2059825","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74985","description":"Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2797","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2797","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2797","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2797","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2797","date":"2026-11-12","epss":0.00526,"percentile":0.45079}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2797"},"relatedVulnerabilities":[{"id":"CVE-2026-2797","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2797","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2797","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2797","date":"2026-11-12","epss":0.00526,"percentile":0.45079}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013561","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://access.redhat.com/security/cve/CVE-2026-2797","https://bugzilla.redhat.com/show_bug.cgi?id=2442330","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2797.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2797","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7529","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7529","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7529","cwe":"CWE-451","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7529","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"risk":0.263,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7529"},"relatedVulnerabilities":[{"id":"CVE-2024-7529","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7529","cwe":"CWE-451","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7529","date":"2026-11-12","epss":0.00526,"percentile":0.45063}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1903187","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/","https://www.mozilla.org/security/advisories/mfsa2024-38/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7529","description":"The date picker could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74987","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74987","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74987","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74987","date":"2026-11-12","epss":0.00523,"percentile":0.44878}],"risk":0.2615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74987"},"relatedVulnerabilities":[{"id":"CVE-2026-74987","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74987","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74987","date":"2026-11-12","epss":0.00523,"percentile":0.44878}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1500946%2C1788109%2C2045379%2C2045380%2C2049339%2C2049393%2C2053580%2C2054662%2C2054665%2C2054673%2C2054785%2C2058645","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2048797%2C2050536%2C2053272%2C2053579%2C2057115%2C2057116%2C2057130%2C2057991%2C2057995%2C2058002%2C2058008%2C2058032%2C2058102%2C2058667","https://bugzilla.mozilla.org/show_bug.cgi?id=2059424","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74987","description":"Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-11-12","epss":0.00521,"percentile":0.44739}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9394","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9394","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9394","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-9394","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9394","date":"2026-11-12","epss":0.00521,"percentile":0.44727}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9394"},"relatedVulnerabilities":[{"id":"CVE-2024-9394","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9394","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-9394","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9394","date":"2026-11-12","epss":0.00521,"percentile":0.44727}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1918874","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-48/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/","https://lists.debian.org/debian-lts-announce/2024/10/msg00004.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9394","description":"An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://devtools` origin.  This could allow them to access cross-origin JSON content. This access is limited to \"same site\" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9187","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9187","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9187","date":"2026-11-12","epss":0.0052,"percentile":0.44661}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9187"},"relatedVulnerabilities":[{"id":"CVE-2025-9187","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9187","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9187","date":"2026-11-12","epss":0.0052,"percentile":0.44661}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1825621%2C1970079%2C1976736%2C1979072","https://www.mozilla.org/security/advisories/mfsa2025-64/","https://www.mozilla.org/security/advisories/mfsa2025-70/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9187","description":"Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11694","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11694","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11694","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11694","date":"2026-11-12","epss":0.00518,"percentile":0.44556}],"risk":0.259,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11694"},"relatedVulnerabilities":[{"id":"CVE-2024-11694","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11694","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11694","date":"2026-11-12","epss":0.00518,"percentile":0.44556}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1924167","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-64/","https://www.mozilla.org/security/advisories/mfsa2024-65/","https://www.mozilla.org/security/advisories/mfsa2024-67/","https://www.mozilla.org/security/advisories/mfsa2024-68/","https://www.mozilla.org/security/advisories/mfsa2024-70/","https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11694","description":"Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Firefox ESR < 115.18, Thunderbird < 133, Thunderbird < 128.5, and Thunderbird < 115.18."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4724","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4724","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4724","cwe":"CWE-758","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4724","date":"2026-11-12","epss":0.00518,"percentile":0.44536}],"risk":0.259,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4724"},"relatedVulnerabilities":[{"id":"CVE-2026-4724","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4724","cwe":"CWE-758","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4724","date":"2026-11-12","epss":0.00518,"percentile":0.44536}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014865","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-23/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4724","description":"Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16353","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16353","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16353","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16353","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16353","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16353","date":"2026-11-12","epss":0.00517,"percentile":0.44501}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16353"},"relatedVulnerabilities":[{"id":"CVE-2026-16353","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16353","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16353","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16353","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16353","date":"2026-11-12","epss":0.00517,"percentile":0.44501}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2049523","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16353","description":"Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4692","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4692","cwe":"CWE-653","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4692","date":"2026-11-12","epss":0.00517,"percentile":0.44496}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4692"},"relatedVulnerabilities":[{"id":"CVE-2026-4692","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4692","cwe":"CWE-653","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4692","date":"2026-11-12","epss":0.00517,"percentile":0.44496}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2017643","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4692","https://bugzilla.redhat.com/show_bug.cgi?id=2450748","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4692.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4692","description":"Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16376","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16376","date":"2026-11-12","epss":0.00517,"percentile":0.44486}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16376"},"relatedVulnerabilities":[{"id":"CVE-2026-16376","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16376","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16376","date":"2026-11-12","epss":0.00517,"percentile":0.44486}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2035733","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16376","description":"Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16409","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16409","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16409","date":"2026-11-12","epss":0.00517,"percentile":0.44486}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16409"},"relatedVulnerabilities":[{"id":"CVE-2026-16409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16409","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16409","date":"2026-11-12","epss":0.00517,"percentile":0.44486}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2052134","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16409","description":"Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7528","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7528","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7528","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7528","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7528","date":"2026-11-12","epss":0.00516,"percentile":0.44436}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7528"},"relatedVulnerabilities":[{"id":"CVE-2024-7528","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7528","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7528","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7528","date":"2026-11-12","epss":0.00516,"percentile":0.44436}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1895951","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7528","description":"Incorrect garbage collection interaction in IndexedDB could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2786","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2786","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2786","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2786","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2786","date":"2026-11-12","epss":0.00514,"percentile":0.44308}],"risk":0.257,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2786"},"relatedVulnerabilities":[{"id":"CVE-2026-2786","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2786","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2786","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2786","date":"2026-11-12","epss":0.00514,"percentile":0.44308}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013612","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2786","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16407","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16407","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16407","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16407","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16407","date":"2026-11-12","epss":0.00514,"percentile":0.44293}],"risk":0.257,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16407"},"relatedVulnerabilities":[{"id":"CVE-2026-16407","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16407","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16407","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16407","date":"2026-11-12","epss":0.00514,"percentile":0.44293}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2044063","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16407","description":"Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-3030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-3030","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-3030","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-3030","date":"2026-11-12","epss":0.00513,"percentile":0.44265}],"risk":0.2565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-3030"},"relatedVulnerabilities":[{"id":"CVE-2025-3030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3030","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-3030","date":"2026-11-12","epss":0.00513,"percentile":0.44265}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1850615%2C1932468%2C1942551%2C1951017%2C1951494","https://www.mozilla.org/security/advisories/mfsa2025-20/","https://www.mozilla.org/security/advisories/mfsa2025-22/","https://www.mozilla.org/security/advisories/mfsa2025-23/","https://www.mozilla.org/security/advisories/mfsa2025-24/","https://lists.debian.org/debian-lts-announce/2025/04/msg00005.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3030","description":"Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4691","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4691","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4691","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4691","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4691","date":"2026-11-12","epss":0.00513,"percentile":0.44262}],"risk":0.2565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4691"},"relatedVulnerabilities":[{"id":"CVE-2026-4691","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4691","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4691","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4691","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4691","date":"2026-11-12","epss":0.00513,"percentile":0.44262}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2017512","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4691","https://bugzilla.redhat.com/show_bug.cgi?id=2450738","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4691.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4691","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6785","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6785","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6785","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6785","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6785","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6785","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6785","date":"2026-11-12","epss":0.00513,"percentile":0.44221}],"risk":0.2565,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6785"},"relatedVulnerabilities":[{"id":"CVE-2026-6785","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6785","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6785","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6785","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6785","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6785","date":"2026-11-12","epss":0.00513,"percentile":0.44221}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1935995%2C1999158%2C2015952%2C2021909%2C2022026%2C2022041%2C2022088%2C2022276%2C2022335%2C2022338%2C2022373%2C2022597%2C2022874%2C2023276%2C2023544%2C2023551%2C2023599%2C2023608%2C2023814%2C2024233%2C2024239%2C2024241%2C2024242%2C2024250%2C2024251%2C2024343%2C2024422%2C2024425%2C2024440%2C2024442%2C2024446%2C2024458%2C2024463%2C2024478%2C2024650%2C2024653%2C2024654%2C2024655%2C2024656%2C2024661%2C2024662%2C2024668%2C2024919%2C2025278%2C2025349%2C2025350%2C2025354%2C2025360%2C2025363%2C2025370%2C2025379%2C2025381%2C2025399%2C2025400%2C2025403%2C2025407%2C2025415%2C2025420%2C2025427%2C2025429%2C2025430%2C2025479%2C2025489%2C2025493%2C2025497%2C2025502%2C2025515%2C2025517%2C2025526%2C2025609%2C2025948%2C2025949%2C2025951%2C2025953%2C2025955%2C2025962%2C2025969%2C2025970%2C2025971%2C2025973%2C2025976%2C2025977%2C2026280%2C2026285%2C2026293%2C2026296%2C2026310%2C2027237%2C2027260%2C2027268%2C2027277%2C2027284%2C2027291%2C2027293%2C2027298%2C2027330%2C2027342%2C2027345%2C2027359%2C2027365%2C2027378%2C2027754%2C2027959%2C2027962%2C2027964%2C2027971%2C2027974%2C2027979%2C2027982%2C2027995%2C2028001%2C2028267%2C2028268%2C2028275%2C2028288%2C2028290%2C2028291%2C2028528%2C2028551%2C2028627%2C2028879%2C2028889%2C2029061%2C2029071%2C2029283%2C2029296%2C2029314%2C2029323%2C2029411%2C2029423%2C2029424%2C2029425%2C2029427%2C2029436%2C2029440%2C2029449%2C2029450%2C2029458%2C2029462%2C2029468%2C2029472%2C2029690%2C2029707%2C2029708%2C2029728%2C2029802%2C2029896%2C2029906%2C2030106%2C2030118%2C2030123%2C2030135%2C2030230%2C2030320","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-31/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6785","https://bugzilla.redhat.com/show_bug.cgi?id=2460104","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6785.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6785","description":"Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8031","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8031","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8031","cwe":"CWE-276","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8031","date":"2026-11-12","epss":0.00511,"percentile":0.44137}],"risk":0.2555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8031"},"relatedVulnerabilities":[{"id":"CVE-2025-8031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8031","cwe":"CWE-276","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8031","date":"2026-11-12","epss":0.00511,"percentile":0.44137}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1971719","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-58/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-62/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8031","description":"The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-54143","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-54143","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-54143","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-54143","date":"2026-11-12","epss":0.0051,"percentile":0.44044}],"risk":0.255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-54143"},"relatedVulnerabilities":[{"id":"CVE-2025-54143","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-54143","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-54143","date":"2026-11-12","epss":0.0051,"percentile":0.44044}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1912671","https://www.mozilla.org/security/advisories/mfsa2025-60/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54143","description":"Sandboxed iframes on webpages could potentially allow downloads to the device, bypassing the expected sandbox restrictions declared on the parent page. This vulnerability was fixed in Firefox for iOS 141."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-11708","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11708","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11708","date":"2026-11-12","epss":0.00509,"percentile":0.4398}],"risk":0.2545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11708"},"relatedVulnerabilities":[{"id":"CVE-2025-11708","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11708","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11708","date":"2026-11-12","epss":0.00509,"percentile":0.4398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1988931","https://www.mozilla.org/security/advisories/mfsa2025-81/","https://www.mozilla.org/security/advisories/mfsa2025-83/","https://www.mozilla.org/security/advisories/mfsa2025-84/","https://www.mozilla.org/security/advisories/mfsa2025-85/","https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11708","description":"Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7518","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7518","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7518","date":"2026-11-12","epss":0.00509,"percentile":0.43968}],"risk":0.2545,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7518"},"relatedVulnerabilities":[{"id":"CVE-2024-7518","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7518","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7518","date":"2026-11-12","epss":0.00509,"percentile":0.43968}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1875354","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-35/","https://www.mozilla.org/security/advisories/mfsa2024-37/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7518","description":"Select options could obscure the fullscreen notification dialog. This could be used by a malicious site to perform a spoofing attack. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-4091","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4091","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4091","date":"2026-11-12","epss":0.00507,"percentile":0.43784}],"risk":0.2535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4091"},"relatedVulnerabilities":[{"id":"CVE-2025-4091","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4091","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4091","date":"2026-11-12","epss":0.00507,"percentile":0.43784}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1951161%2C1952105","https://www.mozilla.org/security/advisories/mfsa2025-28/","https://www.mozilla.org/security/advisories/mfsa2025-29/","https://www.mozilla.org/security/advisories/mfsa2025-31/","https://www.mozilla.org/security/advisories/mfsa2025-32/","https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4091","description":"Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Thunderbird 138, and Thunderbird 128.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9400","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9400","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9400","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9400","date":"2026-11-12","epss":0.00506,"percentile":0.43744}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9400"},"relatedVulnerabilities":[{"id":"CVE-2024-9400","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9400","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9400","date":"2026-11-12","epss":0.00506,"percentile":0.43744}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1915249","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9400","description":"A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5268","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5268","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5268","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-5268","date":"2026-11-12","epss":0.00506,"percentile":0.43689}],"risk":0.253,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5268"},"relatedVulnerabilities":[{"id":"CVE-2025-5268","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5268","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-5268","date":"2026-11-12","epss":0.00506,"percentile":0.43689}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1950136%2C1958121%2C1960499%2C1962634","https://www.mozilla.org/security/advisories/mfsa2025-42/","https://www.mozilla.org/security/advisories/mfsa2025-44/","https://www.mozilla.org/security/advisories/mfsa2025-45/","https://www.mozilla.org/security/advisories/mfsa2025-46/","https://lists.debian.org/debian-lts-announce/2025/05/msg00043.html","https://lists.debian.org/debian-lts-announce/2025/05/msg00046.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5268","description":"Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 139, Firefox ESR 128.11, Thunderbird 139, and Thunderbird 128.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117945","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117945","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117945","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117945","date":"2026-11-12","epss":0.00505,"percentile":0.4367}],"risk":0.2525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117945"},"relatedVulnerabilities":[{"id":"CVE-2026-117945","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117945","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117945","date":"2026-11-12","epss":0.00505,"percentile":0.4367}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082076","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117945","description":"Incorrect boundary conditions in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117982","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117982","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117982","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117982","date":"2026-11-12","epss":0.00505,"percentile":0.4367}],"risk":0.2525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117982"},"relatedVulnerabilities":[{"id":"CVE-2026-117982","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117982","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117982","date":"2026-11-12","epss":0.00505,"percentile":0.4367}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078855","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117982","description":"Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8042","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8042","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8042","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8042","date":"2026-11-12","epss":0.00503,"percentile":0.4354}],"risk":0.2515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8042"},"relatedVulnerabilities":[{"id":"CVE-2025-8042","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8042","cwe":"CWE-732","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8042","date":"2026-11-12","epss":0.00503,"percentile":0.4354}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1791322","https://www.mozilla.org/security/advisories/mfsa2025-56/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8042","description":"Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0879","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0879","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0879","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0879","date":"2026-11-12","epss":0.005,"percentile":0.43377}],"risk":0.25,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0879"},"relatedVulnerabilities":[{"id":"CVE-2026-0879","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0879","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0879","date":"2026-11-12","epss":0.005,"percentile":0.43377}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2004602","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-02/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/","https://access.redhat.com/errata/RHSA-2026:0667","https://access.redhat.com/errata/RHSA-2026:0694","https://access.redhat.com/errata/RHSA-2026:0924","https://access.redhat.com/errata/RHSA-2026:1320","https://access.redhat.com/errata/RHSA-2026:1413","https://access.redhat.com/errata/RHSA-2026:1414","https://access.redhat.com/errata/RHSA-2026:1415","https://access.redhat.com/errata/RHSA-2026:1461","https://access.redhat.com/errata/RHSA-2026:1462","https://access.redhat.com/errata/RHSA-2026:1471","https://access.redhat.com/errata/RHSA-2026:1487","https://access.redhat.com/errata/RHSA-2026:2041","https://access.redhat.com/errata/RHSA-2026:2043","https://access.redhat.com/errata/RHSA-2026:2044","https://access.redhat.com/errata/RHSA-2026:2047","https://access.redhat.com/errata/RHSA-2026:2069","https://access.redhat.com/errata/RHSA-2026:2070","https://access.redhat.com/errata/RHSA-2026:2073","https://access.redhat.com/errata/RHSA-2026:2074","https://access.redhat.com/errata/RHSA-2026:2220","https://access.redhat.com/errata/RHSA-2026:2231","https://access.redhat.com/errata/RHSA-2026:2271","https://access.redhat.com/errata/RHSA-2026:2286","https://access.redhat.com/security/cve/CVE-2026-0879","https://bugzilla.redhat.com/show_bug.cgi?id=2428973","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0879.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0879","description":"Sandbox escape due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6786","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6786","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6786","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6786","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6786","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6786","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6786","date":"2026-11-12","epss":0.00499,"percentile":0.43301}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6786"},"relatedVulnerabilities":[{"id":"CVE-2026-6786","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6786","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6786","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6786","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6786","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6786","date":"2026-11-12","epss":0.00499,"percentile":0.43301}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6786","https://bugzilla.redhat.com/show_bug.cgi?id=2460088","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6786.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6786","description":"Memory safety bugs present in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11706","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11706","date":"2026-11-12","epss":0.00499,"percentile":0.43293}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11706"},"relatedVulnerabilities":[{"id":"CVE-2024-11706","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11706","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11706","date":"2026-11-12","epss":0.00499,"percentile":0.43293}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1923767","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-67/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11706","description":"A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_Util` function, when handling malformed or improperly formatted input files. This vulnerability affects Firefox < 133 and Thunderbird < 133."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74956","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74956","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74956","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74956","date":"2026-11-12","epss":0.00498,"percentile":0.43192}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74956"},"relatedVulnerabilities":[{"id":"CVE-2026-74956","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74956","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74956","date":"2026-11-12","epss":0.00498,"percentile":0.43192}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2032406","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74956","description":"Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8390","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8390","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8390","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8390","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8390","date":"2026-11-12","epss":0.00498,"percentile":0.4318}],"risk":0.249,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8390"},"relatedVulnerabilities":[{"id":"CVE-2026-8390","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8390","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8390","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8390","date":"2026-11-12","epss":0.00498,"percentile":0.4318}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2038081","https://www.mozilla.org/security/advisories/mfsa2026-45/","https://access.redhat.com/security/cve/CVE-2026-8390","https://bugzilla.redhat.com/show_bug.cgi?id=2476474","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8390.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8390","description":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14326","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14326","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14326","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14326","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14326","date":"2026-11-12","epss":0.00496,"percentile":0.43073}],"risk":0.248,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14326"},"relatedVulnerabilities":[{"id":"CVE-2025-14326","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14326","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14326","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14326","date":"2026-11-12","epss":0.00496,"percentile":0.43073}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1840666","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-95/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14326","description":"Use-after-free in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 146 and Thunderbird 146."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9399","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9399","cwe":"CWE-404","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9399","date":"2026-11-12","epss":0.00495,"percentile":0.42985}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9399"},"relatedVulnerabilities":[{"id":"CVE-2024-9399","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9399","cwe":"CWE-404","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9399","date":"2026-11-12","epss":0.00495,"percentile":0.42985}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1907726","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9399","description":"A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8389","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8389","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8389","date":"2026-11-12","epss":0.00493,"percentile":0.42883}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8389"},"relatedVulnerabilities":[{"id":"CVE-2024-8389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8389","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8389","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8389","date":"2026-11-12","epss":0.00493,"percentile":0.42883}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1907230%2C1909367","https://www.mozilla.org/security/advisories/mfsa2024-39/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8389","description":"Memory safety bugs present in Firefox 129. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 130."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12292","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12292","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12292","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12292","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12292","date":"2026-11-12","epss":0.00493,"percentile":0.42876}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12292"},"relatedVulnerabilities":[{"id":"CVE-2026-12292","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12292","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12292","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12292","date":"2026-11-12","epss":0.00493,"percentile":0.42876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2038465","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12292","https://bugzilla.redhat.com/show_bug.cgi?id=2489237","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12292.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12292","description":"Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16411","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16411","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16411","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16411","date":"2026-11-12","epss":0.00493,"percentile":0.42861}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16411"},"relatedVulnerabilities":[{"id":"CVE-2026-16411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16411","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16411","date":"2026-11-12","epss":0.00493,"percentile":0.42861}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1420800%2C1598946%2C1767921%2C2013993%2C2025417%2C2027325%2C2027364%2C2029433%2C2029807%2C2029901%2C2029922%2C2030102%2C2030563%2C2032110%2C2037801%2C2042756%2C2044625%2C2045609%2C2047920%2C2048491%2C2048492%2C2048800%2C2050534%2C2050662%2C2050871","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2006467%2C2027346%2C2027349%2C2027353%2C2027362%2C2027371%2C2027373%2C2028954%2C2029694%2C2036906%2C2038964%2C2039460%2C2040522%2C2040834%2C2043275%2C2045394%2C2045606%2C2052060","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2048936%2C2049804","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16411","description":"Memory safety bugs present in Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4718","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4718","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4718","cwe":"CWE-758","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4718","date":"2026-11-12","epss":0.00492,"percentile":0.42792}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4718"},"relatedVulnerabilities":[{"id":"CVE-2026-4718","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4718","cwe":"CWE-758","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4718","date":"2026-11-12","epss":0.00492,"percentile":0.42792}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014864","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4718","description":"Undefined behavior in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4709","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4709","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4709","date":"2026-11-12","epss":0.00492,"percentile":0.42748}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4709"},"relatedVulnerabilities":[{"id":"CVE-2026-4709","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4709","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4709","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4709","date":"2026-11-12","epss":0.00492,"percentile":0.42748}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016329","https://bugzilla.mozilla.org/show_bug.cgi?id=2016342","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4709","description":"Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117980","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117980","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117980","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117980","date":"2026-11-12","epss":0.00491,"percentile":0.42715}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117980"},"relatedVulnerabilities":[{"id":"CVE-2026-117980","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117980","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117980","date":"2026-11-12","epss":0.00491,"percentile":0.42715}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078145","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117980","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11692","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11692","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11692","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11692","date":"2026-11-12","epss":0.00491,"percentile":0.427}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11692"},"relatedVulnerabilities":[{"id":"CVE-2024-11692","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11692","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11692","date":"2026-11-12","epss":0.00491,"percentile":0.427}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1909535","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-64/","https://www.mozilla.org/security/advisories/mfsa2024-67/","https://www.mozilla.org/security/advisories/mfsa2024-68/","https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11692","description":"An attacker could cause a select dropdown to be shown over another tab; this could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15718","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15718","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15718","cwe":"CWE-763","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-15718","date":"2026-11-12","epss":0.00489,"percentile":0.42617}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15718"},"relatedVulnerabilities":[{"id":"CVE-2026-15718","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15718","cwe":"CWE-763","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-15718","date":"2026-11-12","epss":0.00489,"percentile":0.42617}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2045443","https://www.mozilla.org/security/advisories/mfsa2026-67/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15718","description":"We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4701","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4701","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4701","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4701","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4701","date":"2026-11-12","epss":0.00489,"percentile":0.42604}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4701"},"relatedVulnerabilities":[{"id":"CVE-2026-4701","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4701","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4701","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4701","date":"2026-11-12","epss":0.00489,"percentile":0.42604}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2009303","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4701","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6757","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6757","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6757","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6757","date":"2026-11-12","epss":0.00489,"percentile":0.42596}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6757"},"relatedVulnerabilities":[{"id":"CVE-2026-6757","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6757","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6757","date":"2026-11-12","epss":0.00489,"percentile":0.42596}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013588","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6757","description":"Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7524","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7524","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7524","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7524","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7524","date":"2026-11-12","epss":0.00489,"percentile":0.42581}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7524"},"relatedVulnerabilities":[{"id":"CVE-2024-7524","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7524","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7524","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7524","date":"2026-11-12","epss":0.00489,"percentile":0.42581}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1909241","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7524","description":"Firefox adds web-compatibility shims in place of some tracking scripts blocked by Enhanced Tracking Protection.  On a site protected by Content Security Policy in \"strict-dynamic\" mode, an attacker able to inject an HTML element could have used a DOM Clobbering attack on some of the shims and achieved XSS, bypassing the CSP strict-dynamic protection. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-113399","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-113399","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-113399","date":"2026-11-12","epss":0.00489,"percentile":0.42573}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-113399"},"relatedVulnerabilities":[{"id":"CVE-2026-113399","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113399","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-113399","date":"2026-11-12","epss":0.00489,"percentile":0.42573}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079938","https://www.mozilla.org/security/advisories/mfsa2026-111/","https://www.mozilla.org/security/advisories/mfsa2026-114/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113399","description":"Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2784","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2784","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2784","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2784","date":"2026-11-12","epss":0.00488,"percentile":0.42564}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2784"},"relatedVulnerabilities":[{"id":"CVE-2026-2784","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2784","cwe":"CWE-288","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2784","date":"2026-11-12","epss":0.00488,"percentile":0.42564}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2012984","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2784","description":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1942","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1942","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1942","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1942","date":"2026-11-12","epss":0.00483,"percentile":0.42124}],"risk":0.2415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1942"},"relatedVulnerabilities":[{"id":"CVE-2025-1942","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1942","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1942","date":"2026-11-12","epss":0.00483,"percentile":0.42124}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1947139","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1942","description":"When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability was fixed in Firefox 136 and Thunderbird 136."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8044","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8044","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8044","date":"2026-11-12","epss":0.00483,"percentile":0.4211}],"risk":0.2415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8044"},"relatedVulnerabilities":[{"id":"CVE-2025-8044","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8044","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8044","date":"2026-11-12","epss":0.00483,"percentile":0.4211}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1933572%2C1971116","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-61/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8044","description":"Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141 and Thunderbird 141."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6750","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6750","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6750","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6750","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6750","date":"2026-11-12","epss":0.00483,"percentile":0.42103}],"risk":0.2415,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6750"},"relatedVulnerabilities":[{"id":"CVE-2026-6750","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6750","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6750","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6750","date":"2026-11-12","epss":0.00483,"percentile":0.42103}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2023407","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-31/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6750","https://bugzilla.redhat.com/show_bug.cgi?id=2460102","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6750.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6750","description":"Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-3034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-3034","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-3034","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-3034","date":"2026-11-12","epss":0.00482,"percentile":0.42045}],"risk":0.241,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-3034"},"relatedVulnerabilities":[{"id":"CVE-2025-3034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3034","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-3034","date":"2026-11-12","epss":0.00482,"percentile":0.42045}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1894100%2C1934086%2C1950360","https://www.mozilla.org/security/advisories/mfsa2025-20/","https://www.mozilla.org/security/advisories/mfsa2025-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3034","description":"Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137 and Thunderbird 137."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4706","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4706","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4706","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4706","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4706","date":"2026-11-12","epss":0.0048,"percentile":0.41957}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4706"},"relatedVulnerabilities":[{"id":"CVE-2026-4706","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4706","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4706","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4706","date":"2026-11-12","epss":0.0048,"percentile":0.41957}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015091","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4706","description":"Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12328","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12328","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12328","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12328","date":"2026-11-12","epss":0.00476,"percentile":0.4159}],"risk":0.23800000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12328"},"relatedVulnerabilities":[{"id":"CVE-2026-12328","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12328","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12328","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12328","date":"2026-11-12","epss":0.00476,"percentile":0.4159}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029402%2C2038477%2C2039726%2C2041373%2C2042268%2C2042451%2C2042782%2C2042858%2C2042929%2C2042965%2C2043213","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-59/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12328","https://bugzilla.redhat.com/show_bug.cgi?id=2489218","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12328.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12328","description":"Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0891","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0891","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0891","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0891","date":"2026-11-12","epss":0.00475,"percentile":0.41578}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0891"},"relatedVulnerabilities":[{"id":"CVE-2026-0891","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0891","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0891","date":"2026-11-12","epss":0.00475,"percentile":0.41578}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1964722%2C2000981%2C2003100%2C2003278","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/","https://access.redhat.com/errata/RHSA-2026:0667","https://access.redhat.com/errata/RHSA-2026:0694","https://access.redhat.com/errata/RHSA-2026:0924","https://access.redhat.com/errata/RHSA-2026:1320","https://access.redhat.com/errata/RHSA-2026:1413","https://access.redhat.com/errata/RHSA-2026:1414","https://access.redhat.com/errata/RHSA-2026:1415","https://access.redhat.com/errata/RHSA-2026:1461","https://access.redhat.com/errata/RHSA-2026:1462","https://access.redhat.com/errata/RHSA-2026:1471","https://access.redhat.com/errata/RHSA-2026:1487","https://access.redhat.com/errata/RHSA-2026:2041","https://access.redhat.com/errata/RHSA-2026:2043","https://access.redhat.com/errata/RHSA-2026:2044","https://access.redhat.com/errata/RHSA-2026:2047","https://access.redhat.com/errata/RHSA-2026:2069","https://access.redhat.com/errata/RHSA-2026:2070","https://access.redhat.com/errata/RHSA-2026:2073","https://access.redhat.com/errata/RHSA-2026:2074","https://access.redhat.com/errata/RHSA-2026:2220","https://access.redhat.com/errata/RHSA-2026:2231","https://access.redhat.com/errata/RHSA-2026:2271","https://access.redhat.com/errata/RHSA-2026:2286","https://access.redhat.com/security/cve/CVE-2026-0891","https://bugzilla.redhat.com/show_bug.cgi?id=2428963","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0891.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0891","description":"Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2759","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2759","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2759","cwe":"CWE-1384","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2759","date":"2026-11-12","epss":0.00475,"percentile":0.41551}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2759"},"relatedVulnerabilities":[{"id":"CVE-2026-2759","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2759","cwe":"CWE-1384","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2759","date":"2026-11-12","epss":0.00475,"percentile":0.41551}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2010933","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2759","https://bugzilla.redhat.com/show_bug.cgi?id=2442307","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2759.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2759","description":"Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2760","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2760","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2760","cwe":"CWE-1384","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2760","date":"2026-11-12","epss":0.00475,"percentile":0.41551}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2760"},"relatedVulnerabilities":[{"id":"CVE-2026-2760","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2760","cwe":"CWE-1384","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2760","date":"2026-11-12","epss":0.00475,"percentile":0.41551}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2011062","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2760","https://bugzilla.redhat.com/show_bug.cgi?id=2442325","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2760.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2760","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2761","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2761","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2761","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2761","date":"2026-11-12","epss":0.00475,"percentile":0.41551}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2761"},"relatedVulnerabilities":[{"id":"CVE-2026-2761","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2761","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2761","date":"2026-11-12","epss":0.00475,"percentile":0.41551}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2011063","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2761","https://bugzilla.redhat.com/show_bug.cgi?id=2442309","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2761.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2761","description":"Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14333","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14333","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14333","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14333","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14333","date":"2026-11-12","epss":0.00473,"percentile":0.41439}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14333"},"relatedVulnerabilities":[{"id":"CVE-2025-14333","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14333","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14333","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14333","date":"2026-11-12","epss":0.00473,"percentile":0.41439}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1966501%2C1997639","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14333","description":"Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0877","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0877","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0877","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0877","date":"2026-11-12","epss":0.00473,"percentile":0.41374}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0877"},"relatedVulnerabilities":[{"id":"CVE-2026-0877","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0877","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0877","date":"2026-11-12","epss":0.00473,"percentile":0.41374}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1999257","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-02/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/","https://access.redhat.com/errata/RHSA-2026:0667","https://access.redhat.com/errata/RHSA-2026:0694","https://access.redhat.com/errata/RHSA-2026:0924","https://access.redhat.com/errata/RHSA-2026:1320","https://access.redhat.com/errata/RHSA-2026:1413","https://access.redhat.com/errata/RHSA-2026:1414","https://access.redhat.com/errata/RHSA-2026:1415","https://access.redhat.com/errata/RHSA-2026:1461","https://access.redhat.com/errata/RHSA-2026:1462","https://access.redhat.com/errata/RHSA-2026:1471","https://access.redhat.com/errata/RHSA-2026:1487","https://access.redhat.com/errata/RHSA-2026:2041","https://access.redhat.com/errata/RHSA-2026:2043","https://access.redhat.com/errata/RHSA-2026:2044","https://access.redhat.com/errata/RHSA-2026:2047","https://access.redhat.com/errata/RHSA-2026:2069","https://access.redhat.com/errata/RHSA-2026:2070","https://access.redhat.com/errata/RHSA-2026:2073","https://access.redhat.com/errata/RHSA-2026:2074","https://access.redhat.com/errata/RHSA-2026:2220","https://access.redhat.com/errata/RHSA-2026:2231","https://access.redhat.com/errata/RHSA-2026:2271","https://access.redhat.com/errata/RHSA-2026:2286","https://access.redhat.com/security/cve/CVE-2026-0877","https://bugzilla.redhat.com/show_bug.cgi?id=2428969","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0877.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0877","description":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8975","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8975","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8975","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8975","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8975","date":"2026-11-12","epss":0.00471,"percentile":0.41212}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8975"},"relatedVulnerabilities":[{"id":"CVE-2026-8975","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8975","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8975","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8975","date":"2026-11-12","epss":0.00471,"percentile":0.41212}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1860195%2C2029325%2C2029429%2C2029910%2C2035915%2C2038678%2C2038669","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-47/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/","https://access.redhat.com/errata/RHSA-2026:21378","https://access.redhat.com/errata/RHSA-2026:21380","https://access.redhat.com/errata/RHSA-2026:21381","https://access.redhat.com/errata/RHSA-2026:21382","https://access.redhat.com/errata/RHSA-2026:22325","https://access.redhat.com/errata/RHSA-2026:22643","https://access.redhat.com/errata/RHSA-2026:26174","https://access.redhat.com/errata/RHSA-2026:26268","https://access.redhat.com/errata/RHSA-2026:26269","https://access.redhat.com/errata/RHSA-2026:26270","https://access.redhat.com/errata/RHSA-2026:26491","https://access.redhat.com/errata/RHSA-2026:26492","https://access.redhat.com/errata/RHSA-2026:26493","https://access.redhat.com/errata/RHSA-2026:26521","https://access.redhat.com/errata/RHSA-2026:26536","https://access.redhat.com/errata/RHSA-2026:26539","https://access.redhat.com/errata/RHSA-2026:26551","https://access.redhat.com/errata/RHSA-2026:26606","https://access.redhat.com/errata/RHSA-2026:26629","https://access.redhat.com/errata/RHSA-2026:26630","https://access.redhat.com/errata/RHSA-2026:27715","https://access.redhat.com/security/cve/CVE-2026-8975","https://bugzilla.redhat.com/show_bug.cgi?id=2479840","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8975.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8975","description":"Memory safety bugs present in Thunderbird 140.10 and Thunderbird 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2804","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2804","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2804","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2804","date":"2026-11-12","epss":0.0047,"percentile":0.41111}],"risk":0.23500000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2804"},"relatedVulnerabilities":[{"id":"CVE-2026-2804","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2804","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2804","date":"2026-11-12","epss":0.0047,"percentile":0.41111}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013584","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-16/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2804","description":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0878","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0878","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0878","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-0878","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0878","date":"2026-11-12","epss":0.00469,"percentile":0.4107}],"risk":0.2345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0878"},"relatedVulnerabilities":[{"id":"CVE-2026-0878","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8,"impactScore":5.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0878","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-0878","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0878","date":"2026-11-12","epss":0.00469,"percentile":0.4107}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2003989","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/","https://access.redhat.com/errata/RHSA-2026:0667","https://access.redhat.com/errata/RHSA-2026:0694","https://access.redhat.com/errata/RHSA-2026:0924","https://access.redhat.com/errata/RHSA-2026:1320","https://access.redhat.com/errata/RHSA-2026:1413","https://access.redhat.com/errata/RHSA-2026:1414","https://access.redhat.com/errata/RHSA-2026:1415","https://access.redhat.com/errata/RHSA-2026:1461","https://access.redhat.com/errata/RHSA-2026:1462","https://access.redhat.com/errata/RHSA-2026:1471","https://access.redhat.com/errata/RHSA-2026:1487","https://access.redhat.com/errata/RHSA-2026:2041","https://access.redhat.com/errata/RHSA-2026:2043","https://access.redhat.com/errata/RHSA-2026:2044","https://access.redhat.com/errata/RHSA-2026:2047","https://access.redhat.com/errata/RHSA-2026:2069","https://access.redhat.com/errata/RHSA-2026:2070","https://access.redhat.com/errata/RHSA-2026:2073","https://access.redhat.com/errata/RHSA-2026:2074","https://access.redhat.com/errata/RHSA-2026:2220","https://access.redhat.com/errata/RHSA-2026:2231","https://access.redhat.com/errata/RHSA-2026:2271","https://access.redhat.com/errata/RHSA-2026:2286","https://access.redhat.com/security/cve/CVE-2026-0878","https://bugzilla.redhat.com/show_bug.cgi?id=2428965","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0878.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0878","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8091","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8091","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8091","cwe":"CWE-805","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8091","date":"2026-11-12","epss":0.00469,"percentile":0.41054}],"risk":0.2345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8091"},"relatedVulnerabilities":[{"id":"CVE-2026-8091","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8091","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8091","cwe":"CWE-805","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8091","date":"2026-11-12","epss":0.00469,"percentile":0.41054}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2029301","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-36/","https://www.mozilla.org/security/advisories/mfsa2026-39/","https://www.mozilla.org/security/advisories/mfsa2026-42/","https://access.redhat.com/errata/RHSA-2026:19153","https://access.redhat.com/errata/RHSA-2026:19157","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19370","https://access.redhat.com/errata/RHSA-2026:19588","https://access.redhat.com/errata/RHSA-2026:20586","https://access.redhat.com/errata/RHSA-2026:21743","https://access.redhat.com/errata/RHSA-2026:22324","https://access.redhat.com/errata/RHSA-2026:22408","https://access.redhat.com/errata/RHSA-2026:22409","https://access.redhat.com/errata/RHSA-2026:22410","https://access.redhat.com/errata/RHSA-2026:22708","https://access.redhat.com/errata/RHSA-2026:22712","https://access.redhat.com/errata/RHSA-2026:22847","https://access.redhat.com/errata/RHSA-2026:24345","https://access.redhat.com/errata/RHSA-2026:24717","https://access.redhat.com/errata/RHSA-2026:24718","https://access.redhat.com/errata/RHSA-2026:24719","https://access.redhat.com/errata/RHSA-2026:24721","https://access.redhat.com/errata/RHSA-2026:24844","https://access.redhat.com/errata/RHSA-2026:24846","https://access.redhat.com/errata/RHSA-2026:25014","https://access.redhat.com/security/cve/CVE-2026-8091","https://bugzilla.redhat.com/show_bug.cgi?id=2467699","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8091.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8091","description":"Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16360","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16360","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16360","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16360","date":"2026-11-12","epss":0.00468,"percentile":0.41036}],"risk":0.234,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16360"},"relatedVulnerabilities":[{"id":"CVE-2026-16360","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16360","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16360","date":"2026-11-12","epss":0.00468,"percentile":0.41036}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022635%2C2028004%2C2035756%2C2045184%2C2045185%2C2045198%2C2045392%2C2045395%2C2045396%2C2045397%2C2045405%2C2045414%2C2045415%2C2045451%2C2045454%2C2045508%2C2045510%2C2045513%2C2045515%2C2045518%2C2045604%2C2045607%2C2045612%2C2045617%2C2045619%2C2045624%2C2045625%2C2045729%2C2045737%2C2045741%2C2045742%2C2045763%2C2045767%2C2045770%2C2045772%2C2045773%2C2045783%2C2045833%2C2045848%2C2045865%2C2045875%2C2045957%2C2047723%2C2047729%2C2048795%2C2048799%2C2048801%2C2049392%2C2049397%2C2049398%2C2049399%2C2049404%2C2049405%2C2049407%2C2049812%2C2050657%2C2050668%2C2050990%2C2053166%2C2053273%2C2053576%2C2053583%2C2053587","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043739%2C2045281%2C2045614%2C2045744%2C2045775%2C2047719%2C2049805%2C2051666","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16360","description":"Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117981","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117981","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117981","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117981","date":"2026-11-12","epss":0.00467,"percentile":0.40938}],"risk":0.23349999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117981"},"relatedVulnerabilities":[{"id":"CVE-2026-117981","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117981","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117981","date":"2026-11-12","epss":0.00467,"percentile":0.40938}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078167","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117981","description":"Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0882","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0882","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0882","date":"2026-11-12","epss":0.00465,"percentile":0.40769}],"risk":0.23249999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0882"},"relatedVulnerabilities":[{"id":"CVE-2026-0882","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0882","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0882","date":"2026-11-12","epss":0.00465,"percentile":0.40769}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1924125","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-02/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/","https://access.redhat.com/errata/RHSA-2026:0667","https://access.redhat.com/errata/RHSA-2026:0694","https://access.redhat.com/errata/RHSA-2026:0924","https://access.redhat.com/errata/RHSA-2026:1320","https://access.redhat.com/errata/RHSA-2026:1413","https://access.redhat.com/errata/RHSA-2026:1414","https://access.redhat.com/errata/RHSA-2026:1415","https://access.redhat.com/errata/RHSA-2026:1461","https://access.redhat.com/errata/RHSA-2026:1462","https://access.redhat.com/errata/RHSA-2026:1471","https://access.redhat.com/errata/RHSA-2026:1487","https://access.redhat.com/errata/RHSA-2026:2041","https://access.redhat.com/errata/RHSA-2026:2043","https://access.redhat.com/errata/RHSA-2026:2044","https://access.redhat.com/errata/RHSA-2026:2047","https://access.redhat.com/errata/RHSA-2026:2069","https://access.redhat.com/errata/RHSA-2026:2070","https://access.redhat.com/errata/RHSA-2026:2073","https://access.redhat.com/errata/RHSA-2026:2074","https://access.redhat.com/errata/RHSA-2026:2220","https://access.redhat.com/errata/RHSA-2026:2231","https://access.redhat.com/errata/RHSA-2026:2271","https://access.redhat.com/errata/RHSA-2026:2286","https://access.redhat.com/security/cve/CVE-2026-0882","https://bugzilla.redhat.com/show_bug.cgi?id=2428966","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-0882.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0882","description":"Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-5262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-5262","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-5262","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-5262","date":"2026-11-12","epss":0.00464,"percentile":0.40685}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-5262"},"relatedVulnerabilities":[{"id":"CVE-2025-5262","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-5262","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-5262","date":"2026-11-12","epss":0.00464,"percentile":0.40685}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1962421","https://www.mozilla.org/security/advisories/mfsa2025-45/","https://www.mozilla.org/security/advisories/mfsa2025-46/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-5262","description":"A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 139 and Thunderbird < 128.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0884","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0884","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0884","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0884","date":"2026-11-12","epss":0.00463,"percentile":0.40651}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0884"},"relatedVulnerabilities":[{"id":"CVE-2026-0884","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0884","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0884","date":"2026-11-12","epss":0.00463,"percentile":0.40651}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2003588","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0884","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0889","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0889","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0889","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0889","date":"2026-11-12","epss":0.00463,"percentile":0.40635}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0889"},"relatedVulnerabilities":[{"id":"CVE-2026-0889","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0889","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0889","date":"2026-11-12","epss":0.00463,"percentile":0.40635}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1999084","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-04/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0889","description":"Denial-of-service in the DOM: Service Workers component. This vulnerability was fixed in Firefox 147 and Thunderbird 147."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109733","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109733","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109733","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-109733","date":"2026-11-12","epss":0.00462,"percentile":0.40571}],"risk":0.231,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109733"},"relatedVulnerabilities":[{"id":"CVE-2026-109733","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109733","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-109733","date":"2026-11-12","epss":0.00462,"percentile":0.40571}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076269","https://www.mozilla.org/security/advisories/mfsa2026-106/","https://www.mozilla.org/security/advisories/mfsa2026-107/","https://www.mozilla.org/security/advisories/mfsa2026-108/","https://www.mozilla.org/security/advisories/mfsa2026-109/","https://www.mozilla.org/security/advisories/mfsa2026-110/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109733","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2767","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2767","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2767","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2767","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2767","date":"2026-11-12","epss":0.00462,"percentile":0.40497}],"risk":0.231,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2767"},"relatedVulnerabilities":[{"id":"CVE-2026-2767","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2767","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2767","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2767","date":"2026-11-12","epss":0.00462,"percentile":0.40497}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013741","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2767","https://bugzilla.redhat.com/show_bug.cgi?id=2442328","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2767.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2767","description":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11695","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11695","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11695","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11695","date":"2026-11-12","epss":0.00461,"percentile":0.40444}],"risk":0.2305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11695"},"relatedVulnerabilities":[{"id":"CVE-2024-11695","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11695","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11695","date":"2026-11-12","epss":0.00461,"percentile":0.40444}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1925496","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-64/","https://www.mozilla.org/security/advisories/mfsa2024-67/","https://www.mozilla.org/security/advisories/mfsa2024-68/","https://lists.debian.org/debian-lts-announce/2024/11/msg00029.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11695","description":"A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerability affects Firefox < 133, Firefox ESR < 128.5, Thunderbird < 133, and Thunderbird < 128.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1010","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1010","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1010","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1010","date":"2026-11-12","epss":0.00461,"percentile":0.40435}],"risk":0.2305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1010"},"relatedVulnerabilities":[{"id":"CVE-2025-1010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1010","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1010","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1010","date":"2026-11-12","epss":0.00461,"percentile":0.40435}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1936982","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-08/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1010","description":"An attacker could have caused a use-after-free via the Custom Highlight API, leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8034","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8034","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8034","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8034","date":"2026-11-12","epss":0.00461,"percentile":0.40426}],"risk":0.2305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8034"},"relatedVulnerabilities":[{"id":"CVE-2025-8034","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8034","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8034","date":"2026-11-12","epss":0.00461,"percentile":0.40426}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1970422","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-57/","https://www.mozilla.org/security/advisories/mfsa2025-58/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-62/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8034","description":"Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4708","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4708","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4708","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4708","date":"2026-11-12","epss":0.0046,"percentile":0.40383}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4708"},"relatedVulnerabilities":[{"id":"CVE-2026-4708","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4708","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4708","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4708","date":"2026-11-12","epss":0.0046,"percentile":0.40383}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015268","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4708","description":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4713","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4713","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4713","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4713","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4713","date":"2026-11-12","epss":0.0046,"percentile":0.40382}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4713"},"relatedVulnerabilities":[{"id":"CVE-2026-4713","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4713","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4713","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4713","date":"2026-11-12","epss":0.0046,"percentile":0.40382}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2018113","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4713","description":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4714","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4714","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4714","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4714","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4714","date":"2026-11-12","epss":0.0046,"percentile":0.40382}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4714"},"relatedVulnerabilities":[{"id":"CVE-2026-4714","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4714","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4714","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4714","date":"2026-11-12","epss":0.0046,"percentile":0.40382}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2018126","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4714","description":"Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4719","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4719","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4719","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4719","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4719","date":"2026-11-12","epss":0.0046,"percentile":0.40382}],"risk":0.22999999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4719"},"relatedVulnerabilities":[{"id":"CVE-2026-4719","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4719","cwe":"CWE-754","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4719","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4719","date":"2026-11-12","epss":0.0046,"percentile":0.40382}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016367","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4719","description":"Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-4083","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4083","cwe":"CWE-653","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4083","date":"2026-11-12","epss":0.00459,"percentile":0.40243}],"risk":0.2295,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4083"},"relatedVulnerabilities":[{"id":"CVE-2025-4083","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4083","cwe":"CWE-653","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-4083","date":"2026-11-12","epss":0.00459,"percentile":0.40243}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1958350","https://www.mozilla.org/security/advisories/mfsa2025-28/","https://www.mozilla.org/security/advisories/mfsa2025-29/","https://www.mozilla.org/security/advisories/mfsa2025-30/","https://www.mozilla.org/security/advisories/mfsa2025-31/","https://www.mozilla.org/security/advisories/mfsa2025-32/","https://lists.debian.org/debian-lts-announce/2025/05/msg00024.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4083","description":"A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process instead of the intended frame, potentially enabling a sandbox escape. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6435","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-6435","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6435","cwe":"CWE-434","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-6435","date":"2026-11-12","epss":0.00457,"percentile":0.40132}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6435"},"relatedVulnerabilities":[{"id":"CVE-2025-6435","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6435","cwe":"CWE-434","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-6435","date":"2026-11-12","epss":0.00457,"percentile":0.40132}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1950056","https://bugzilla.mozilla.org/show_bug.cgi?id=1961777","https://www.mozilla.org/security/advisories/mfsa2025-51/","https://www.mozilla.org/security/advisories/mfsa2025-54/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6435","description":"If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability was fixed in Firefox 140 and Thunderbird 140."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4715","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4715","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4715","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4715","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4715","date":"2026-11-12","epss":0.00457,"percentile":0.40089}],"risk":0.2285,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4715"},"relatedVulnerabilities":[{"id":"CVE-2026-4715","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4715","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4715","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4715","date":"2026-11-12","epss":0.00457,"percentile":0.40089}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2018405","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4715","description":"Uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75874","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75874","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75874","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75874","date":"2026-11-12","epss":0.00455,"percentile":0.39989}],"risk":0.2275,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75874"},"relatedVulnerabilities":[{"id":"CVE-2026-75874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75874","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-75874","date":"2026-11-12","epss":0.00455,"percentile":0.39989}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2039972","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-83/","https://www.mozilla.org/security/advisories/mfsa2026-84/","https://www.mozilla.org/security/advisories/mfsa2026-85/","https://www.mozilla.org/security/advisories/mfsa2026-87/","https://www.mozilla.org/security/advisories/mfsa2026-88/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75874","description":"Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 140.15, and Thunderbird 153.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2806","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2806","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2806","date":"2026-11-12","epss":0.00454,"percentile":0.39864}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2806"},"relatedVulnerabilities":[{"id":"CVE-2026-2806","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2806","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-2806","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2806","date":"2026-11-12","epss":0.00454,"percentile":0.39864}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2006199","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-16/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2806","description":"Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1934","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1934","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1934","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1934","date":"2026-11-12","epss":0.00453,"percentile":0.3979}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1934"},"relatedVulnerabilities":[{"id":"CVE-2025-1934","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1934","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-1934","date":"2026-11-12","epss":0.00453,"percentile":0.3979}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1942881","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-16/","https://www.mozilla.org/security/advisories/mfsa2025-17/","https://www.mozilla.org/security/advisories/mfsa2025-18/","https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1934","description":"It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was not expecting it. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1414","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1414","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1414","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1414","date":"2026-11-12","epss":0.00453,"percentile":0.39782}],"risk":0.2265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1414"},"relatedVulnerabilities":[{"id":"CVE-2025-1414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1414","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1414","date":"2026-11-12","epss":0.00453,"percentile":0.39782}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1943179","https://www.mozilla.org/security/advisories/mfsa2025-12/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1414","description":"Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74958","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74958","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74958","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74958","date":"2026-11-12","epss":0.00452,"percentile":0.39758}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74958"},"relatedVulnerabilities":[{"id":"CVE-2026-74958","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74958","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74958","date":"2026-11-12","epss":0.00452,"percentile":0.39758}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2045368","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74958","description":"Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118177","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118177","date":"2026-11-12","epss":0.00452,"percentile":0.39726}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118177"},"relatedVulnerabilities":[{"id":"CVE-2026-118177","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118177","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118177","date":"2026-11-12","epss":0.00452,"percentile":0.39726}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2080924","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118177","description":"When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0892","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0892","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0892","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0892","date":"2026-11-12","epss":0.00452,"percentile":0.39722}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0892"},"relatedVulnerabilities":[{"id":"CVE-2026-0892","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0892","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0892","date":"2026-11-12","epss":0.00452,"percentile":0.39722}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1986912%2C1996718%2C1999633%2C2001081%2C2004443","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-04/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0892","description":"Memory safety bugs present in Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 147 and Thunderbird 147."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4720","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4720","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4720","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4720","date":"2026-11-12","epss":0.0045,"percentile":0.39596}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4720"},"relatedVulnerabilities":[{"id":"CVE-2026-4720","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4720","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4720","cwe":"CWE-120","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4720","date":"2026-11-12","epss":0.0045,"percentile":0.39596}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2004652%2C2019372%2C2021922%2C2022567%2C2022733","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4720","https://bugzilla.redhat.com/show_bug.cgi?id=2450751","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4720.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4720","description":"Memory safety bugs present in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4721","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4721","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4721","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4721","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4721","date":"2026-11-12","epss":0.0045,"percentile":0.39596}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4721"},"relatedVulnerabilities":[{"id":"CVE-2026-4721","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4721","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-4721","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-4721","date":"2026-11-12","epss":0.0045,"percentile":0.39596}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2013762%2C2015291%2C2016591%2C2016661%2C2016664%2C2017303%2C2017894%2C2018090%2C2018196%2C2018379%2C2019112%2C2022090%2C2022243%2C2022351%2C2022478%2C2022676","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-21/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/","https://access.redhat.com/errata/RHSA-2026:5930","https://access.redhat.com/errata/RHSA-2026:5931","https://access.redhat.com/errata/RHSA-2026:5932","https://access.redhat.com/errata/RHSA-2026:6188","https://access.redhat.com/errata/RHSA-2026:6342","https://access.redhat.com/errata/RHSA-2026:6917","https://access.redhat.com/errata/RHSA-2026:7837","https://access.redhat.com/errata/RHSA-2026:7838","https://access.redhat.com/errata/RHSA-2026:7839","https://access.redhat.com/errata/RHSA-2026:7840","https://access.redhat.com/errata/RHSA-2026:7841","https://access.redhat.com/errata/RHSA-2026:7842","https://access.redhat.com/errata/RHSA-2026:7843","https://access.redhat.com/errata/RHSA-2026:7845","https://access.redhat.com/errata/RHSA-2026:7858","https://access.redhat.com/errata/RHSA-2026:8284","https://access.redhat.com/errata/RHSA-2026:8285","https://access.redhat.com/errata/RHSA-2026:8286","https://access.redhat.com/errata/RHSA-2026:8287","https://access.redhat.com/errata/RHSA-2026:8288","https://access.redhat.com/errata/RHSA-2026:8289","https://access.redhat.com/errata/RHSA-2026:8290","https://access.redhat.com/errata/RHSA-2026:8315","https://access.redhat.com/errata/RHSA-2026:8427","https://access.redhat.com/errata/RHSA-2026:8850","https://access.redhat.com/security/cve/CVE-2026-4721","https://bugzilla.redhat.com/show_bug.cgi?id=2450711","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4721.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4721","description":"Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1012","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1012","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1012","date":"2026-11-12","epss":0.00449,"percentile":0.39534}],"risk":0.2245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1012"},"relatedVulnerabilities":[{"id":"CVE-2025-1012","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1012","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1012","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1012","date":"2026-11-12","epss":0.00449,"percentile":0.39534}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1939710","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-08/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00005.html","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1012","description":"A race during concurrent delazification could have led to a use-after-free. This vulnerability was fixed in Firefox 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84135","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84135","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84135","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-84135","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84135","date":"2026-11-12","epss":0.00449,"percentile":0.3953}],"risk":0.2245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84135"},"relatedVulnerabilities":[{"id":"CVE-2026-84135","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84135","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-84135","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84135","date":"2026-11-12","epss":0.00449,"percentile":0.3953}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2046661","https://www.mozilla.org/security/advisories/mfsa2026-82/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84135","description":"Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74947","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74947","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74947","cwe":"CWE-763","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74947","date":"2026-11-12","epss":0.00449,"percentile":0.39501}],"risk":0.2245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74947"},"relatedVulnerabilities":[{"id":"CVE-2026-74947","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74947","cwe":"CWE-763","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74947","date":"2026-11-12","epss":0.00449,"percentile":0.39501}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2060010","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74947","description":"Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9403","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9403","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9403","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9403","date":"2026-11-12","epss":0.00447,"percentile":0.39373}],"risk":0.2235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9403"},"relatedVulnerabilities":[{"id":"CVE-2024-9403","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9403","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9403","date":"2026-11-12","epss":0.00447,"percentile":0.39373}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1917807","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-50/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9403","description":"Memory safety bugs present in Firefox 130. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 131 and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1936","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1936","cwe":"CWE-158","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1936","date":"2026-11-12","epss":0.00447,"percentile":0.39328}],"risk":0.2235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1936"},"relatedVulnerabilities":[{"id":"CVE-2025-1936","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1936","cwe":"CWE-158","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1936","date":"2026-11-12","epss":0.00447,"percentile":0.39328}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1940027","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-16/","https://www.mozilla.org/security/advisories/mfsa2025-17/","https://www.mozilla.org/security/advisories/mfsa2025-18/","https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1936","description":"jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension disguised as something else like an image. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8036","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8036","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8036","cwe":"CWE-350","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8036","date":"2026-11-12","epss":0.00446,"percentile":0.39246}],"risk":0.22300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8036"},"relatedVulnerabilities":[{"id":"CVE-2025-8036","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8036","cwe":"CWE-350","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8036","date":"2026-11-12","epss":0.00446,"percentile":0.39246}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1960834","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://www.kb.cert.org/vuls/id/652514"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8036","description":"Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14323","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14323","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2025-14323","date":"2026-11-12","epss":0.00445,"percentile":0.39131}],"risk":0.2225,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14323"},"relatedVulnerabilities":[{"id":"CVE-2025-14323","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-14323","date":"2026-11-12","epss":0.00445,"percentile":0.39131}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1996555","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-93/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14323","description":"Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4717","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4717","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-4717","date":"2026-11-12","epss":0.00443,"percentile":0.39017}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4717"},"relatedVulnerabilities":[{"id":"CVE-2026-4717","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4717","date":"2026-11-12","epss":0.00443,"percentile":0.39017}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2021695","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4717","description":"Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74961","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74961","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74961","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74961","date":"2026-11-12","epss":0.00443,"percentile":0.39005}],"risk":0.2215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74961"},"relatedVulnerabilities":[{"id":"CVE-2026-74961","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74961","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74961","date":"2026-11-12","epss":0.00443,"percentile":0.39005}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2050380","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74961","description":"Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74938","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74938","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74938","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74938","date":"2026-11-12","epss":0.00442,"percentile":0.38876}],"risk":0.22100000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74938"},"relatedVulnerabilities":[{"id":"CVE-2026-74938","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74938","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74938","date":"2026-11-12","epss":0.00442,"percentile":0.38876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2053688","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74938","description":"Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2768","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-2768","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2768","date":"2026-11-12","epss":0.00439,"percentile":0.38672}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2768"},"relatedVulnerabilities":[{"id":"CVE-2026-2768","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-2768","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2768","date":"2026-11-12","epss":0.00439,"percentile":0.38672}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2014101","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2768","https://bugzilla.redhat.com/show_bug.cgi?id=2442298","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2768.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2768","description":"Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2777","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2777","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2777","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2777","date":"2026-11-12","epss":0.00439,"percentile":0.38672}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2777"},"relatedVulnerabilities":[{"id":"CVE-2026-2777","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2777","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2777","date":"2026-11-12","epss":0.00439,"percentile":0.38672}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2015305","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-14/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/","https://access.redhat.com/errata/RHSA-2026:3338","https://access.redhat.com/errata/RHSA-2026:3339","https://access.redhat.com/errata/RHSA-2026:3361","https://access.redhat.com/errata/RHSA-2026:3491","https://access.redhat.com/errata/RHSA-2026:3492","https://access.redhat.com/errata/RHSA-2026:3493","https://access.redhat.com/errata/RHSA-2026:3494","https://access.redhat.com/errata/RHSA-2026:3495","https://access.redhat.com/errata/RHSA-2026:3496","https://access.redhat.com/errata/RHSA-2026:3497","https://access.redhat.com/errata/RHSA-2026:3515","https://access.redhat.com/errata/RHSA-2026:3516","https://access.redhat.com/errata/RHSA-2026:3517","https://access.redhat.com/errata/RHSA-2026:3976","https://access.redhat.com/errata/RHSA-2026:3978","https://access.redhat.com/errata/RHSA-2026:3979","https://access.redhat.com/errata/RHSA-2026:3980","https://access.redhat.com/errata/RHSA-2026:3981","https://access.redhat.com/errata/RHSA-2026:3982","https://access.redhat.com/errata/RHSA-2026:3983","https://access.redhat.com/errata/RHSA-2026:3984","https://access.redhat.com/errata/RHSA-2026:4022","https://access.redhat.com/errata/RHSA-2026:4152","https://access.redhat.com/errata/RHSA-2026:4260","https://access.redhat.com/errata/RHSA-2026:4432","https://access.redhat.com/security/cve/CVE-2026-2777","https://bugzilla.redhat.com/show_bug.cgi?id=2442312","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2777.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2777","description":"Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84130","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84130","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84130","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84130","date":"2026-11-12","epss":0.00439,"percentile":0.38628}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84130"},"relatedVulnerabilities":[{"id":"CVE-2026-84130","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84130","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84130","date":"2026-11-12","epss":0.00439,"percentile":0.38628}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2057834","https://www.mozilla.org/security/advisories/mfsa2026-82/","https://www.mozilla.org/security/advisories/mfsa2026-85/","https://www.mozilla.org/security/advisories/mfsa2026-86/","https://www.mozilla.org/security/advisories/mfsa2026-88/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84130","description":"Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74954","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74954","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74954","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74954","date":"2026-11-12","epss":0.00439,"percentile":0.38627}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74954"},"relatedVulnerabilities":[{"id":"CVE-2026-74954","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74954","cwe":"CWE-203","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74954","date":"2026-11-12","epss":0.00439,"percentile":0.38627}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2025732","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74954","description":"Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74966","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74966","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74966","cwe":"CWE-359","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74966","date":"2026-11-12","epss":0.00439,"percentile":0.38627}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74966"},"relatedVulnerabilities":[{"id":"CVE-2026-74966","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74966","cwe":"CWE-359","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74966","date":"2026-11-12","epss":0.00439,"percentile":0.38627}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2054776","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74966","description":"Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1943","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1943","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1943","date":"2026-11-12","epss":0.00437,"percentile":0.385}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1943"},"relatedVulnerabilities":[{"id":"CVE-2025-1943","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1943","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1943","date":"2026-11-12","epss":0.00437,"percentile":0.385}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1869650%2C1938451%2C1940326%2C1944052%2C1944063%2C1947281","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-17/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1943","description":"Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 136 and Thunderbird 136."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8043","cwe":"CWE-451","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8043","date":"2026-11-12","epss":0.00437,"percentile":0.38499}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8043"},"relatedVulnerabilities":[{"id":"CVE-2025-8043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8043","cwe":"CWE-451","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8043","date":"2026-11-12","epss":0.00437,"percentile":0.38499}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1970209","https://www.mozilla.org/security/advisories/mfsa2025-56/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8043","description":"Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7531","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7531","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-11-12","epss":0.00437,"percentile":0.38482}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7531"},"relatedVulnerabilities":[{"id":"CVE-2024-7531","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"impactScore":3.4,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7531","cwe":"CWE-367","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7531","date":"2026-11-12","epss":0.00437,"percentile":0.38482}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1905691","https://www.mozilla.org/security/advisories/mfsa2024-33/","https://www.mozilla.org/security/advisories/mfsa2024-34/","https://www.mozilla.org/security/advisories/mfsa2024-35/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7531","description":"Calling `PK11_Encrypt()` in NSS using CKM_CHACHA20 and the same buffer for input and output can result in plaintext on an Intel Sandy Bridge processor. In Firefox this only affects the QUIC header protection feature when the connection is using the ChaCha20-Poly1305 cipher suite. The most likely outcome is connection failure, but if the connection persists despite the high packet loss it could be possible for a network observer to identify packets as coming from the same source despite a network path change. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, and Firefox ESR < 128.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84128","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84128","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84128","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84128","date":"2026-11-12","epss":0.00437,"percentile":0.38457}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84128"},"relatedVulnerabilities":[{"id":"CVE-2026-84128","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84128","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84128","date":"2026-11-12","epss":0.00437,"percentile":0.38457}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2044280","https://www.mozilla.org/security/advisories/mfsa2026-82/","https://www.mozilla.org/security/advisories/mfsa2026-86/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84128","description":"Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84123","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84123","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84123","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84123","date":"2026-11-12","epss":0.00436,"percentile":0.38416}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84123"},"relatedVulnerabilities":[{"id":"CVE-2026-84123","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84123","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84123","date":"2026-11-12","epss":0.00436,"percentile":0.38416}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2060047","https://www.mozilla.org/security/advisories/mfsa2026-82/","https://www.mozilla.org/security/advisories/mfsa2026-85/","https://www.mozilla.org/security/advisories/mfsa2026-86/","https://www.mozilla.org/security/advisories/mfsa2026-88/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84123","description":"Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74937","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74937","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74937","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74937","date":"2026-11-12","epss":0.00436,"percentile":0.38415}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74937"},"relatedVulnerabilities":[{"id":"CVE-2026-74937","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74937","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74937","date":"2026-11-12","epss":0.00436,"percentile":0.38415}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2053337","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74937","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9182","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9182","date":"2026-11-12","epss":0.00436,"percentile":0.38398}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9182"},"relatedVulnerabilities":[{"id":"CVE-2025-9182","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9182","date":"2026-11-12","epss":0.00436,"percentile":0.38398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1975837","https://www.mozilla.org/security/advisories/mfsa2025-64/","https://www.mozilla.org/security/advisories/mfsa2025-67/","https://www.mozilla.org/security/advisories/mfsa2025-70/","https://www.mozilla.org/security/advisories/mfsa2025-72/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9182","description":"Denial-of-service due to out-of-memory in the Graphics: WebRender component. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16363","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16363","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16363","cwe":"CWE-682","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16363","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16363","date":"2026-11-12","epss":0.00436,"percentile":0.38368}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16363"},"relatedVulnerabilities":[{"id":"CVE-2026-16363","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16363","cwe":"CWE-682","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16363","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16363","date":"2026-11-12","epss":0.00436,"percentile":0.38368}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2047689","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16363","description":"JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16369","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16369","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16369","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16369","date":"2026-11-12","epss":0.00436,"percentile":0.38368}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16369"},"relatedVulnerabilities":[{"id":"CVE-2026-16369","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16369","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16369","date":"2026-11-12","epss":0.00436,"percentile":0.38368}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2051854","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16369","description":"Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4710","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4710","date":"2026-11-12","epss":0.00435,"percentile":0.38223}],"risk":0.21749999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4710"},"relatedVulnerabilities":[{"id":"CVE-2026-4710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4710","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4710","date":"2026-11-12","epss":0.00435,"percentile":0.38223}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2016370","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4710","description":"Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117925","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117925","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117925","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117925","date":"2026-11-12","epss":0.00433,"percentile":0.38092}],"risk":0.21649999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117925"},"relatedVulnerabilities":[{"id":"CVE-2026-117925","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117925","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117925","date":"2026-11-12","epss":0.00433,"percentile":0.38092}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079786","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117925","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16370","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16370","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16370","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16370","date":"2026-11-12","epss":0.00432,"percentile":0.37998}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16370"},"relatedVulnerabilities":[{"id":"CVE-2026-16370","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16370","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16370","date":"2026-11-12","epss":0.00432,"percentile":0.37998}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1996495","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16370","description":"Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16394","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16394","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16394","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16394","date":"2026-11-12","epss":0.00432,"percentile":0.37997}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16394"},"relatedVulnerabilities":[{"id":"CVE-2026-16394","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16394","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16394","date":"2026-11-12","epss":0.00432,"percentile":0.37997}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2046748","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16394","description":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16406","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16406","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16406","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16406","date":"2026-11-12","epss":0.00432,"percentile":0.37997}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16406"},"relatedVulnerabilities":[{"id":"CVE-2026-16406","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16406","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16406","date":"2026-11-12","epss":0.00432,"percentile":0.37997}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2040382","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16406","description":"Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4716","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4716","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4716","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4716","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4716","date":"2026-11-12","epss":0.00432,"percentile":0.37969}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4716"},"relatedVulnerabilities":[{"id":"CVE-2026-4716","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4716","cwe":"CWE-908","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4716","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4716","date":"2026-11-12","epss":0.00432,"percentile":0.37969}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2018592","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4716","description":"Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8027","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8027","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8027","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8027","date":"2026-11-12","epss":0.00432,"percentile":0.37882}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8027"},"relatedVulnerabilities":[{"id":"CVE-2025-8027","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8027","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8027","date":"2026-11-12","epss":0.00432,"percentile":0.37882}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1968423","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-57/","https://www.mozilla.org/security/advisories/mfsa2025-58/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-62/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8027","description":"On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, however, read the entire 64 bits. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8033","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8033","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8033","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8033","date":"2026-11-12","epss":0.00432,"percentile":0.37882}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8033"},"relatedVulnerabilities":[{"id":"CVE-2025-8033","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8033","cwe":"CWE-476","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8033","date":"2026-11-12","epss":0.00432,"percentile":0.37882}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1973990","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-57/","https://www.mozilla.org/security/advisories/mfsa2025-58/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-62/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8033","description":"The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr deref. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14328","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14328","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2025-14328","date":"2026-11-12","epss":0.00431,"percentile":0.378}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14328"},"relatedVulnerabilities":[{"id":"CVE-2025-14328","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-14328","date":"2026-11-12","epss":0.00431,"percentile":0.378}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1996761","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14328","description":"Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14329","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14329","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2025-14329","date":"2026-11-12","epss":0.00431,"percentile":0.378}],"risk":0.21549999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14329"},"relatedVulnerabilities":[{"id":"CVE-2025-14329","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-14329","date":"2026-11-12","epss":0.00431,"percentile":0.378}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1997018","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-94/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2025-96/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14329","description":"Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14241","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14241","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14241","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-14241","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-14241","date":"2026-11-12","epss":0.0043,"percentile":0.37694}],"risk":0.215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14241"},"relatedVulnerabilities":[{"id":"CVE-2026-14241","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14241","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-14241","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-14241","date":"2026-11-12","epss":0.0043,"percentile":0.37694}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2043241%2C2045514%2C2045576%2C2045623%2C2045765%2C2049409%2C2049840","https://bugzilla.mozilla.org/show_bug.cgi?id=2046814","https://www.mozilla.org/security/advisories/mfsa2026-62/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14241","description":"Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16364","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16364","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16364","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16364","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16364","date":"2026-11-12","epss":0.00429,"percentile":0.37591}],"risk":0.21450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16364"},"relatedVulnerabilities":[{"id":"CVE-2026-16364","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16364","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16364","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16364","date":"2026-11-12","epss":0.00429,"percentile":0.37591}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2047802","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16364","description":"Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84144","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84144","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84144","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84144","date":"2026-11-12","epss":0.00425,"percentile":0.37262}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84144"},"relatedVulnerabilities":[{"id":"CVE-2026-84144","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84144","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-84144","date":"2026-11-12","epss":0.00425,"percentile":0.37262}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054619%2C2054620%2C2054624%2C2054702%2C2054726%2C2054775%2C2055703%2C2058006%2C2058013%2C2058098%2C2058627%2C2058661%2C2059127%2C2059128%2C2059180%2C2059199%2C2059205%2C2061320%2C2061430%2C2061495%2C2061505%2C2061532%2C2061799","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054625%2C2059002%2C2061775","https://bugzilla.mozilla.org/buglist.cgi?bug_id=2054691%2C2058085%2C2059144%2C2059191%2C2059192%2C2061521%2C2062395%2C2062404","https://www.mozilla.org/security/advisories/mfsa2026-82/","https://www.mozilla.org/security/advisories/mfsa2026-85/","https://www.mozilla.org/security/advisories/mfsa2026-86/","https://www.mozilla.org/security/advisories/mfsa2026-88/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84144","description":"Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8954","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8954","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8954","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8954","date":"2026-11-12","epss":0.00425,"percentile":0.37241}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8954"},"relatedVulnerabilities":[{"id":"CVE-2026-8954","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8954","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8954","date":"2026-11-12","epss":0.00425,"percentile":0.37241}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2030747","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8954","description":"Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16384","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16384","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16384","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16384","date":"2026-11-12","epss":0.00425,"percentile":0.37213}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16384"},"relatedVulnerabilities":[{"id":"CVE-2026-16384","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16384","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16384","date":"2026-11-12","epss":0.00425,"percentile":0.37213}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041911","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16384","description":"Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16385","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16385","date":"2026-11-12","epss":0.00425,"percentile":0.37213}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16385"},"relatedVulnerabilities":[{"id":"CVE-2026-16385","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16385","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16385","date":"2026-11-12","epss":0.00425,"percentile":0.37213}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041912","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16385","description":"Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16386","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16386","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16386","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16386","date":"2026-11-12","epss":0.00425,"percentile":0.37212}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16386"},"relatedVulnerabilities":[{"id":"CVE-2026-16386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16386","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16386","date":"2026-11-12","epss":0.00425,"percentile":0.37212}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041916","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16386","description":"Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16400","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16400","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16400","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16400","date":"2026-11-12","epss":0.00425,"percentile":0.37212}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16400"},"relatedVulnerabilities":[{"id":"CVE-2026-16400","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16400","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16400","date":"2026-11-12","epss":0.00425,"percentile":0.37212}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2050430","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16400","description":"Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5aa54dcd4065f953","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"cafce1d90847e84b","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d826ca636f6430ca","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"3b95a991af0d4b60","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.20.1-6ubuntu2.10:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.20.1-6ubuntu2.10?arch=amd64&distro=ubuntu-24.04&upstream=krb5","type":"deb","version":"1.20.1-6ubuntu2.10","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"krb5","version":"1.20.1-6ubuntu2.10"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-11-12","epss":0.00424,"percentile":0.37194}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1932","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1932","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1932","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1932","date":"2026-11-12","epss":0.00423,"percentile":0.37139}],"risk":0.21150000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1932"},"relatedVulnerabilities":[{"id":"CVE-2025-1932","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1932","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1932","date":"2026-11-12","epss":0.00423,"percentile":0.37139}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1944313","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-16/","https://www.mozilla.org/security/advisories/mfsa2025-17/","https://www.mozilla.org/security/advisories/mfsa2025-18/","https://lists.debian.org/debian-lts-announce/2025/03/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1932","description":"An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This vulnerability was fixed in Firefox 136, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4711","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4711","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4711","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4711","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4711","date":"2026-11-12","epss":0.00422,"percentile":0.3703}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4711"},"relatedVulnerabilities":[{"id":"CVE-2026-4711","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4711","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-4711","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4711","date":"2026-11-12","epss":0.00422,"percentile":0.3703}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2017002","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4711","description":"Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11709","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-11709","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11709","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11709","date":"2026-11-12","epss":0.00422,"percentile":0.37018}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11709"},"relatedVulnerabilities":[{"id":"CVE-2025-11709","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11709","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11709","date":"2026-11-12","epss":0.00422,"percentile":0.37018}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1989127","https://www.mozilla.org/security/advisories/mfsa2025-81/","https://www.mozilla.org/security/advisories/mfsa2025-82/","https://www.mozilla.org/security/advisories/mfsa2025-83/","https://www.mozilla.org/security/advisories/mfsa2025-84/","https://www.mozilla.org/security/advisories/mfsa2025-85/","https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11709","description":"A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-11710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-11710","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-11710","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11710","date":"2026-11-12","epss":0.00422,"percentile":0.37018}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-11710"},"relatedVulnerabilities":[{"id":"CVE-2025-11710","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-11710","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-11710","date":"2026-11-12","epss":0.00422,"percentile":0.37018}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1989899","https://www.mozilla.org/security/advisories/mfsa2025-81/","https://www.mozilla.org/security/advisories/mfsa2025-82/","https://www.mozilla.org/security/advisories/mfsa2025-83/","https://www.mozilla.org/security/advisories/mfsa2025-84/","https://www.mozilla.org/security/advisories/mfsa2025-85/","https://lists.debian.org/debian-lts-announce/2025/10/msg00015.html","https://lists.debian.org/debian-lts-announce/2025/10/msg00031.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-11710","description":"A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to the compromised process. This vulnerability was fixed in Firefox 144, Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird 144, and Thunderbird 140.4."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92040","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92040","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92040","date":"2026-11-12","epss":0.00422,"percentile":0.37018}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92040"},"relatedVulnerabilities":[{"id":"CVE-2026-92040","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92040","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92040","date":"2026-11-12","epss":0.00422,"percentile":0.37018}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2024248","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92040","description":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8389","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8389","cwe":"CWE-686","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8389","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8389","cwe":"CWE-733","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8389","date":"2026-11-12","epss":0.00422,"percentile":0.36962}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8389"},"relatedVulnerabilities":[{"id":"CVE-2026-8389","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8389","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8389","cwe":"CWE-686","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8389","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8389","cwe":"CWE-733","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8389","date":"2026-11-12","epss":0.00422,"percentile":0.36962}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2036983","https://www.mozilla.org/security/advisories/mfsa2026-45/","https://access.redhat.com/security/cve/CVE-2026-8389","https://bugzilla.redhat.com/show_bug.cgi?id=2476466","https://github.com/crixpwn/CVE-2026-8389","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8389.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8389","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8948","cwe":"CWE-942","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8948","cwe":"CWE-79","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8948","date":"2026-11-12","epss":0.0042,"percentile":0.36805}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8948"},"relatedVulnerabilities":[{"id":"CVE-2026-8948","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8948","cwe":"CWE-942","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8948","cwe":"CWE-79","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8948","date":"2026-11-12","epss":0.0042,"percentile":0.36805}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2038803","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://access.redhat.com/security/cve/CVE-2026-8948","https://bugzilla.redhat.com/show_bug.cgi?id=2479850","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8948.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8948","description":"Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9184","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9184","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9184","date":"2026-11-12","epss":0.0042,"percentile":0.36804}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9184"},"relatedVulnerabilities":[{"id":"CVE-2025-9184","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9184","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9184","date":"2026-11-12","epss":0.0042,"percentile":0.36804}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1929482%2C1976376%2C1979163%2C1979955","https://www.mozilla.org/security/advisories/mfsa2025-64/","https://www.mozilla.org/security/advisories/mfsa2025-67/","https://www.mozilla.org/security/advisories/mfsa2025-70/","https://www.mozilla.org/security/advisories/mfsa2025-72/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9184","description":"Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142, Firefox ESR 140.2, Thunderbird 142, and Thunderbird 140.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-11701","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-11701","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-11701","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11701","date":"2026-11-12","epss":0.0042,"percentile":0.36797}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-11701"},"relatedVulnerabilities":[{"id":"CVE-2024-11701","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-11701","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-11701","date":"2026-11-12","epss":0.0042,"percentile":0.36797}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1914797","https://www.mozilla.org/security/advisories/mfsa2024-63/","https://www.mozilla.org/security/advisories/mfsa2024-67/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-11701","description":"The incorrect domain may have been displayed in the address bar during an interrupted navigation attempt. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 133 and Thunderbird < 133."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-54145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-54145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-54145","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-54145","date":"2026-11-12","epss":0.00418,"percentile":0.36605}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-54145"},"relatedVulnerabilities":[{"id":"CVE-2025-54145","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-54145","cwe":"CWE-601","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-54145","date":"2026-11-12","epss":0.00418,"percentile":0.36605}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1946122","https://www.mozilla.org/security/advisories/mfsa2025-60/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-54145","description":"The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme. This vulnerability was fixed in Firefox for iOS 141."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16378","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16378","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16378","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16378","date":"2026-11-12","epss":0.00417,"percentile":0.36532}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16378"},"relatedVulnerabilities":[{"id":"CVE-2026-16378","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16378","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16378","date":"2026-11-12","epss":0.00417,"percentile":0.36532}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2038868","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16378","description":"Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8959","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8959","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8959","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8959","date":"2026-11-12","epss":0.00417,"percentile":0.36464}],"risk":0.20850000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8959"},"relatedVulnerabilities":[{"id":"CVE-2026-8959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8959","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8959","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8959","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8959","date":"2026-11-12","epss":0.00417,"percentile":0.36464}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2034754","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8959","description":"Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10468","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10468","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10468","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10468","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10468","date":"2026-11-12","epss":0.00416,"percentile":0.36429}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10468"},"relatedVulnerabilities":[{"id":"CVE-2024-10468","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10468","cwe":"CWE-362","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-10468","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10468","date":"2026-11-12","epss":0.00416,"percentile":0.36429}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1914982","https://www.mozilla.org/security/advisories/mfsa2024-55/","https://www.mozilla.org/security/advisories/mfsa2024-59/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10468","description":"Potential race conditions in IndexedDB could have caused memory corruption, leading to a potentially exploitable crash. This vulnerability affects Firefox < 132 and Thunderbird < 132."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74950","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74950","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74950","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74950","date":"2026-11-12","epss":0.00415,"percentile":0.36326}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74950"},"relatedVulnerabilities":[{"id":"CVE-2026-74950","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74950","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74950","date":"2026-11-12","epss":0.00415,"percentile":0.36326}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1880253","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74950","description":"Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74955","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74955","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74955","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74955","date":"2026-11-12","epss":0.00415,"percentile":0.36326}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74955"},"relatedVulnerabilities":[{"id":"CVE-2026-74955","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74955","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74955","date":"2026-11-12","epss":0.00415,"percentile":0.36326}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2029265","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74955","description":"Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74952","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74952","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74952","date":"2026-11-12","epss":0.00415,"percentile":0.36325}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74952"},"relatedVulnerabilities":[{"id":"CVE-2026-74952","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74952","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74952","date":"2026-11-12","epss":0.00415,"percentile":0.36325}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2021757","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-85/","https://www.mozilla.org/security/advisories/mfsa2026-88/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74952","description":"Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100788","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-100788","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100788","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-100788","date":"2026-11-12","epss":0.00415,"percentile":0.36259}],"risk":0.2075,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100788"},"relatedVulnerabilities":[{"id":"CVE-2026-100788","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100788","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-100788","date":"2026-11-12","epss":0.00415,"percentile":0.36259}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2072413","https://www.mozilla.org/security/advisories/mfsa2026-100/","https://www.mozilla.org/security/advisories/mfsa2026-101/","https://www.mozilla.org/security/advisories/mfsa2026-102/","https://www.mozilla.org/security/advisories/mfsa2026-103/","https://www.mozilla.org/security/advisories/mfsa2026-97/","https://www.mozilla.org/security/advisories/mfsa2026-99/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100788","description":"Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8092","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8092","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8092","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8092","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8092","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8092","date":"2026-11-12","epss":0.00414,"percentile":0.36228}],"risk":0.207,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8092"},"relatedVulnerabilities":[{"id":"CVE-2026-8092","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8092","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8092","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8092","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8092","cwe":"CWE-787","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8092","date":"2026-11-12","epss":0.00414,"percentile":0.36228}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=1806249%2C2021977%2C2022576%2C2022722%2C2024439%2C2027883%2C2029463%2C2030323%2C2032042%2C2032043%2C2033270%2C2033637%2C2034422%2C2034496%2C2035879%2C2036516","https://www.mozilla.org/security/advisories/mfsa2026-40/","https://www.mozilla.org/security/advisories/mfsa2026-41/","https://www.mozilla.org/security/advisories/mfsa2026-42/","https://www.mozilla.org/security/advisories/mfsa2026-43/","https://www.mozilla.org/security/advisories/mfsa2026-44/","https://access.redhat.com/errata/RHSA-2026:19160","https://access.redhat.com/errata/RHSA-2026:20566","https://access.redhat.com/errata/RHSA-2026:20574","https://access.redhat.com/errata/RHSA-2026:21381","https://access.redhat.com/errata/RHSA-2026:22325","https://access.redhat.com/errata/RHSA-2026:22643","https://access.redhat.com/errata/RHSA-2026:24508","https://access.redhat.com/errata/RHSA-2026:24509","https://access.redhat.com/errata/RHSA-2026:24510","https://access.redhat.com/errata/RHSA-2026:24511","https://access.redhat.com/errata/RHSA-2026:24516","https://access.redhat.com/errata/RHSA-2026:24755","https://access.redhat.com/errata/RHSA-2026:24983","https://access.redhat.com/errata/RHSA-2026:25015","https://access.redhat.com/errata/RHSA-2026:26174","https://access.redhat.com/errata/RHSA-2026:26268","https://access.redhat.com/errata/RHSA-2026:26269","https://access.redhat.com/errata/RHSA-2026:26270","https://access.redhat.com/errata/RHSA-2026:26521","https://access.redhat.com/errata/RHSA-2026:26536","https://access.redhat.com/errata/RHSA-2026:26539","https://access.redhat.com/security/cve/CVE-2026-8092","https://bugzilla.redhat.com/show_bug.cgi?id=2467708","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8092.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8092","description":"Memory safety bugs present in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8947","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8947","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8947","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8947","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8947","date":"2026-11-12","epss":0.00413,"percentile":0.36138}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8947"},"relatedVulnerabilities":[{"id":"CVE-2026-8947","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8947","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-8947","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-8947","date":"2026-11-12","epss":0.00413,"percentile":0.36138}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2038439","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-47/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/","https://access.redhat.com/errata/RHSA-2026:21378","https://access.redhat.com/errata/RHSA-2026:21380","https://access.redhat.com/errata/RHSA-2026:21381","https://access.redhat.com/errata/RHSA-2026:21382","https://access.redhat.com/errata/RHSA-2026:22325","https://access.redhat.com/errata/RHSA-2026:22643","https://access.redhat.com/errata/RHSA-2026:26174","https://access.redhat.com/errata/RHSA-2026:26268","https://access.redhat.com/errata/RHSA-2026:26269","https://access.redhat.com/errata/RHSA-2026:26270","https://access.redhat.com/errata/RHSA-2026:26491","https://access.redhat.com/errata/RHSA-2026:26492","https://access.redhat.com/errata/RHSA-2026:26493","https://access.redhat.com/errata/RHSA-2026:26521","https://access.redhat.com/errata/RHSA-2026:26536","https://access.redhat.com/errata/RHSA-2026:26539","https://access.redhat.com/errata/RHSA-2026:26551","https://access.redhat.com/errata/RHSA-2026:26606","https://access.redhat.com/errata/RHSA-2026:26629","https://access.redhat.com/errata/RHSA-2026:26630","https://access.redhat.com/errata/RHSA-2026:27715","https://access.redhat.com/security/cve/CVE-2026-8947","https://bugzilla.redhat.com/show_bug.cgi?id=2479873","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8947.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8947","description":"Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8968","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8968","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8968","date":"2026-11-12","epss":0.00413,"percentile":0.36135}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8968"},"relatedVulnerabilities":[{"id":"CVE-2026-8968","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8968","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8968","date":"2026-11-12","epss":0.00413,"percentile":0.36135}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2030467","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8968","description":"Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9181","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-9181","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9181","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9181","date":"2026-11-12","epss":0.00413,"percentile":0.36042}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9181"},"relatedVulnerabilities":[{"id":"CVE-2025-9181","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9181","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-9181","date":"2026-11-12","epss":0.00413,"percentile":0.36042}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1977130","https://www.mozilla.org/security/advisories/mfsa2025-64/","https://www.mozilla.org/security/advisories/mfsa2025-66/","https://www.mozilla.org/security/advisories/mfsa2025-67/","https://www.mozilla.org/security/advisories/mfsa2025-70/","https://www.mozilla.org/security/advisories/mfsa2025-71/","https://www.mozilla.org/security/advisories/mfsa2025-72/","https://lists.debian.org/debian-lts-announce/2025/08/msg00016.html","https://lists.debian.org/debian-lts-announce/2025/08/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9181","description":"Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74940","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74940","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74940","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74940","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74940","date":"2026-11-12","epss":0.00412,"percentile":0.36002}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74940"},"relatedVulnerabilities":[{"id":"CVE-2026-74940","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74940","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74940","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74940","date":"2026-11-12","epss":0.00412,"percentile":0.36002}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2054842","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-75/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74940","description":"Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13016","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13016","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13016","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13016","date":"2026-11-12","epss":0.00411,"percentile":0.3588}],"risk":0.2055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13016"},"relatedVulnerabilities":[{"id":"CVE-2025-13016","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13016","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13016","date":"2026-11-12","epss":0.00411,"percentile":0.3588}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1992130","https://www.mozilla.org/security/advisories/mfsa2025-87/","https://www.mozilla.org/security/advisories/mfsa2025-88/","https://www.mozilla.org/security/advisories/mfsa2025-90/","https://www.mozilla.org/security/advisories/mfsa2025-91/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13016","description":"Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117967","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117967","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117967","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117967","date":"2026-11-12","epss":0.0041,"percentile":0.35796}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117967"},"relatedVulnerabilities":[{"id":"CVE-2026-117967","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117967","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117967","date":"2026-11-12","epss":0.0041,"percentile":0.35796}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2075930","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117967","description":"Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117998","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117998","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117998","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117998","date":"2026-11-12","epss":0.0041,"percentile":0.35796}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117998"},"relatedVulnerabilities":[{"id":"CVE-2026-117998","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117998","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117998","date":"2026-11-12","epss":0.0041,"percentile":0.35796}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2042021","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117998","description":"Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92050","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92050","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92050","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92050","date":"2026-11-12","epss":0.0041,"percentile":0.35766}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92050"},"relatedVulnerabilities":[{"id":"CVE-2026-92050","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92050","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92050","date":"2026-11-12","epss":0.0041,"percentile":0.35766}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2061387","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92050","description":"Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4712","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-4712","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4712","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4712","date":"2026-11-12","epss":0.00409,"percentile":0.35676}],"risk":0.2045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4712"},"relatedVulnerabilities":[{"id":"CVE-2026-4712","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4712","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-4712","date":"2026-11-12","epss":0.00409,"percentile":0.35676}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2017666","https://www.mozilla.org/security/advisories/mfsa2026-20/","https://www.mozilla.org/security/advisories/mfsa2026-22/","https://www.mozilla.org/security/advisories/mfsa2026-23/","https://www.mozilla.org/security/advisories/mfsa2026-24/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4712","description":"Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-109704","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109704","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-109704","date":"2026-11-12","epss":0.00409,"percentile":0.35644}],"risk":0.2045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109704"},"relatedVulnerabilities":[{"id":"CVE-2026-109704","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109704","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-109704","date":"2026-11-12","epss":0.00409,"percentile":0.35644}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2037979","https://www.mozilla.org/security/advisories/mfsa2026-106/","https://www.mozilla.org/security/advisories/mfsa2026-108/","https://www.mozilla.org/security/advisories/mfsa2026-109/","https://www.mozilla.org/security/advisories/mfsa2026-110/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109704","description":"Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117950","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117950","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117950","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117950","date":"2026-11-12","epss":0.00408,"percentile":0.35614}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117950"},"relatedVulnerabilities":[{"id":"CVE-2026-117950","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117950","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117950","date":"2026-11-12","epss":0.00408,"percentile":0.35614}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082127","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117950","description":"Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117979","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117979","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117979","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117979","date":"2026-11-12","epss":0.00408,"percentile":0.35614}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117979"},"relatedVulnerabilities":[{"id":"CVE-2026-117979","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117979","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117979","date":"2026-11-12","epss":0.00408,"percentile":0.35614}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2077739","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117979","description":"Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124853","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124853","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124853","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124853","date":"2026-11-12","epss":0.00408,"percentile":0.35614}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124853"},"relatedVulnerabilities":[{"id":"CVE-2026-124853","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124853","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124853","date":"2026-11-12","epss":0.00408,"percentile":0.35614}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2058035","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124853","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117868","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117868","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117868","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117868","date":"2026-11-12","epss":0.00408,"percentile":0.35613}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117868"},"relatedVulnerabilities":[{"id":"CVE-2026-117868","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117868","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117868","date":"2026-11-12","epss":0.00408,"percentile":0.35613}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2059961","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117868","description":"Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124859","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124859","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124859","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124859","date":"2026-11-12","epss":0.00408,"percentile":0.35613}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124859"},"relatedVulnerabilities":[{"id":"CVE-2026-124859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124859","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124859","date":"2026-11-12","epss":0.00408,"percentile":0.35613}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2074179","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124859","description":"Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124875","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124875","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124875","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124875","date":"2026-11-12","epss":0.00408,"percentile":0.35613}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124875"},"relatedVulnerabilities":[{"id":"CVE-2026-124875","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124875","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124875","date":"2026-11-12","epss":0.00408,"percentile":0.35613}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081380","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124875","description":"Incorrect boundary conditions in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1018","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1018","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1018","cwe":"CWE-1021","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1018","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1018","date":"2026-11-12","epss":0.00407,"percentile":0.35509}],"risk":0.2035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1018"},"relatedVulnerabilities":[{"id":"CVE-2025-1018","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1018","cwe":"CWE-1021","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1018","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1018","date":"2026-11-12","epss":0.00407,"percentile":0.35509}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1910818","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-11/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1018","description":"The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12327","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12327","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12327","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12327","date":"2026-11-12","epss":0.00407,"percentile":0.3544}],"risk":0.2035,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12327"},"relatedVulnerabilities":[{"id":"CVE-2026-12327","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12327","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-12327","date":"2026-11-12","epss":0.00407,"percentile":0.3544}],"urls":["https://bugzilla.mozilla.org/buglist.cgi?bug_id=2011842%2C2023902%2C2025512%2C2027312%2C2029444%2C2036571%2C2036900%2C2036936%2C2037995%2C2038551%2C2040717%2C2042724","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12327","description":"Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16372","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16372","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16372","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16372","date":"2026-11-12","epss":0.00406,"percentile":0.35403}],"risk":0.203,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16372"},"relatedVulnerabilities":[{"id":"CVE-2026-16372","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16372","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16372","date":"2026-11-12","epss":0.00406,"percentile":0.35403}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2013800","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16372","description":"Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14327","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-14327","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14327","cwe":"CWE-290","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14327","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14327","date":"2026-11-12","epss":0.00406,"percentile":0.35364}],"risk":0.203,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14327"},"relatedVulnerabilities":[{"id":"CVE-2025-14327","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14327","cwe":"CWE-290","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-14327","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-14327","date":"2026-11-12","epss":0.00406,"percentile":0.35364}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1970743","https://www.mozilla.org/security/advisories/mfsa2025-92/","https://www.mozilla.org/security/advisories/mfsa2025-95/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-05/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14327","description":"Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92239","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92239","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92239","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92239","date":"2026-11-12","epss":0.00406,"percentile":0.35324}],"risk":0.203,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92239"},"relatedVulnerabilities":[{"id":"CVE-2026-92239","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92239","cwe":"CWE-125","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92239","date":"2026-11-12","epss":0.00406,"percentile":0.35324}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2060488","https://www.mozilla.org/security/advisories/mfsa2026-94/","https://www.mozilla.org/security/advisories/mfsa2026-95/","https://www.mozilla.org/security/advisories/mfsa2026-96/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92239","description":"A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-3032","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-3032","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-3032","cwe":"CWE-403","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-3032","date":"2026-11-12","epss":0.00406,"percentile":0.35309}],"risk":0.203,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-3032"},"relatedVulnerabilities":[{"id":"CVE-2025-3032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-3032","cwe":"CWE-403","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-3032","date":"2026-11-12","epss":0.00406,"percentile":0.35309}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1949987","https://www.mozilla.org/security/advisories/mfsa2025-20/","https://www.mozilla.org/security/advisories/mfsa2025-23/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-3032","description":"Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox 137 and Thunderbird 137."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16355","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16355","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16355","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16355","date":"2026-11-12","epss":0.00405,"percentile":0.35271}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16355"},"relatedVulnerabilities":[{"id":"CVE-2026-16355","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16355","cwe":"CWE-843","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16355","date":"2026-11-12","epss":0.00405,"percentile":0.35271}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2052207","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16355","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16350","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16350","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16350","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16350","date":"2026-11-12","epss":0.00405,"percentile":0.3527}],"risk":0.20249999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16350"},"relatedVulnerabilities":[{"id":"CVE-2026-16350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16350","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16350","date":"2026-11-12","epss":0.00405,"percentile":0.3527}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2042033","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16350","description":"Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0885","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0885","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0885","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0885","date":"2026-11-12","epss":0.00404,"percentile":0.35104}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0885"},"relatedVulnerabilities":[{"id":"CVE-2026-0885","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0885","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0885","date":"2026-11-12","epss":0.00404,"percentile":0.35104}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2003607","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0885","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6749","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6749","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6749","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6749","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6749","date":"2026-11-12","epss":0.00403,"percentile":0.35066}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6749"},"relatedVulnerabilities":[{"id":"CVE-2026-6749","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6749","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6749","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6749","date":"2026-11-12","epss":0.00403,"percentile":0.35066}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2022610","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-31/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6749","https://bugzilla.redhat.com/show_bug.cgi?id=2460096","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6749.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6749","description":"Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74936","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74936","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74936","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74936","date":"2026-11-12","epss":0.00403,"percentile":0.35052}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74936"},"relatedVulnerabilities":[{"id":"CVE-2026-74936","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74936","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74936","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74936","date":"2026-11-12","epss":0.00403,"percentile":0.35052}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2052688","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74936","description":"Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74944","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74944","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74944","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74944","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74944","date":"2026-11-12","epss":0.00403,"percentile":0.35052}],"risk":0.20149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74944"},"relatedVulnerabilities":[{"id":"CVE-2026-74944","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74944","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-74944","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74944","date":"2026-11-12","epss":0.00403,"percentile":0.35052}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2057778","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74944","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16366","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16366","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16366","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16366","date":"2026-11-12","epss":0.00402,"percentile":0.3491}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16366"},"relatedVulnerabilities":[{"id":"CVE-2026-16366","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16366","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16366","date":"2026-11-12","epss":0.00402,"percentile":0.3491}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2049181","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16366","description":"Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16401","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16401","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16401","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16401","date":"2026-11-12","epss":0.00402,"percentile":0.3491}],"risk":0.201,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16401"},"relatedVulnerabilities":[{"id":"CVE-2026-16401","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16401","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16401","date":"2026-11-12","epss":0.00402,"percentile":0.3491}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2052565","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-71/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16401","description":"Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-8035","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-8035","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-8035","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8035","date":"2026-11-12","epss":0.00401,"percentile":0.34854}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-8035"},"relatedVulnerabilities":[{"id":"CVE-2025-8035","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-8035","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-8035","date":"2026-11-12","epss":0.00401,"percentile":0.34854}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1975961","https://www.mozilla.org/security/advisories/mfsa2025-56/","https://www.mozilla.org/security/advisories/mfsa2025-58/","https://www.mozilla.org/security/advisories/mfsa2025-59/","https://www.mozilla.org/security/advisories/mfsa2025-61/","https://www.mozilla.org/security/advisories/mfsa2025-62/","https://www.mozilla.org/security/advisories/mfsa2025-63/","https://lists.debian.org/debian-lts-announce/2025/07/msg00016.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8035","description":"Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1930","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1930","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1930","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1930","date":"2026-11-12","epss":0.00401,"percentile":0.3484}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1930"},"relatedVulnerabilities":[{"id":"CVE-2025-1930","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1930","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1930","date":"2026-11-12","epss":0.00401,"percentile":0.3484}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1902309","https://www.mozilla.org/security/advisories/mfsa2025-14/","https://www.mozilla.org/security/advisories/mfsa2025-15/","https://www.mozilla.org/security/advisories/mfsa2025-16/","https://www.mozilla.org/security/advisories/mfsa2025-17/","https://www.mozilla.org/security/advisories/mfsa2025-18/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1930","description":"On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6747","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6747","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6747","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6747","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6747","date":"2026-11-12","epss":0.004,"percentile":0.34742}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6747"},"relatedVulnerabilities":[{"id":"CVE-2026-6747","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6747","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6747","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6747","date":"2026-11-12","epss":0.004,"percentile":0.34742}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2021769","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6747","https://bugzilla.redhat.com/show_bug.cgi?id=2460095","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6747.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6747","description":"Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118176","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118176","date":"2026-11-12","epss":0.004,"percentile":0.347}],"risk":0.2,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118176"},"relatedVulnerabilities":[{"id":"CVE-2026-118176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118176","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118176","date":"2026-11-12","epss":0.004,"percentile":0.347}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081141","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118176","description":"Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.\nThis bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6748","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6748","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6748","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6748","date":"2026-11-12","epss":0.00399,"percentile":0.34616}],"risk":0.19949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6748"},"relatedVulnerabilities":[{"id":"CVE-2026-6748","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6748","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6748","cwe":"CWE-824","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6748","date":"2026-11-12","epss":0.00399,"percentile":0.34616}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2022604","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6748","https://bugzilla.redhat.com/show_bug.cgi?id=2460103","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6748.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6748","description":"Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118175","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-118175","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-118175","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118175","date":"2026-11-12","epss":0.00399,"percentile":0.34572}],"risk":0.19949999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-118175"},"relatedVulnerabilities":[{"id":"CVE-2026-118175","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118175","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-118175","date":"2026-11-12","epss":0.00399,"percentile":0.34572}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081720","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118175","description":"When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-9393","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-9393","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-9393","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-9393","cwe":"CWE-346","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9393","date":"2026-11-12","epss":0.00397,"percentile":0.3444}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-9393"},"relatedVulnerabilities":[{"id":"CVE-2024-9393","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-9393","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-9393","cwe":"CWE-346","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-9393","date":"2026-11-12","epss":0.00397,"percentile":0.3444}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1918301","https://www.mozilla.org/security/advisories/mfsa2024-46/","https://www.mozilla.org/security/advisories/mfsa2024-47/","https://www.mozilla.org/security/advisories/mfsa2024-48/","https://www.mozilla.org/security/advisories/mfsa2024-49/","https://www.mozilla.org/security/advisories/mfsa2024-50/","https://lists.debian.org/debian-lts-announce/2024/10/msg00004.html","https://lists.debian.org/debian-lts-announce/2024/10/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-9393","description":"An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the `resource://pdf.js` origin.  This could allow them to access cross-origin PDF content. This access is limited to \"same site\" documents by the Site Isolation feature on desktop clients, but full cross-origin access is possible on Android versions. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Firefox ESR < 115.16, Thunderbird < 128.3, and Thunderbird < 131."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12290","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12290","cwe":"CWE-823","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12290","date":"2026-11-12","epss":0.00397,"percentile":0.34429}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12290"},"relatedVulnerabilities":[{"id":"CVE-2026-12290","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12290","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12290","cwe":"CWE-823","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12290","date":"2026-11-12","epss":0.00397,"percentile":0.34429}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2024852","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-59/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12290","https://bugzilla.redhat.com/show_bug.cgi?id=2489210","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12290.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12290","description":"Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117968","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117968","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117968","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117968"},"relatedVulnerabilities":[{"id":"CVE-2026-117968","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117968","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117968","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2075985","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117968","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124872","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124872","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124872","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124872","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124872"},"relatedVulnerabilities":[{"id":"CVE-2026-124872","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124872","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124872","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079689","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124872","description":"Use-after-free in the Cycle Collector component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124881","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124881","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124881","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124881","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124881"},"relatedVulnerabilities":[{"id":"CVE-2026-124881","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124881","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124881","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081980","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124881","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124882","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124882","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124882","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124882","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124882"},"relatedVulnerabilities":[{"id":"CVE-2026-124882","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124882","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124882","date":"2026-11-12","epss":0.00397,"percentile":0.34406}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081982","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124882","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124876","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124876","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124876","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124876","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124876"},"relatedVulnerabilities":[{"id":"CVE-2026-124876","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124876","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124876","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081550","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124876","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124890","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124890","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124890","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124890","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124890"},"relatedVulnerabilities":[{"id":"CVE-2026-124890","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124890","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124890","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082039","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124890","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124895","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124895","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124895","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124895","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124895"},"relatedVulnerabilities":[{"id":"CVE-2026-124895","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124895","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124895","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082109","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124895","description":"Use-after-free in the Storage: localStorage & sessionStorage component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124898","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124898","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124898","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124898","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124898"},"relatedVulnerabilities":[{"id":"CVE-2026-124898","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124898","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124898","date":"2026-11-12","epss":0.00397,"percentile":0.34405}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082205","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124898","description":"Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117922","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117922","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117922","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117922","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117922"},"relatedVulnerabilities":[{"id":"CVE-2026-117922","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117922","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117922","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079692","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117922","description":"Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117971","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117971","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117971","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117971","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117971"},"relatedVulnerabilities":[{"id":"CVE-2026-117971","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117971","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117971","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076399","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117971","description":"Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124861","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124861","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124861"},"relatedVulnerabilities":[{"id":"CVE-2026-124861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124861","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124861","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2074210","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124861","description":"Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124864","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124864","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124864","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124864","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124864"},"relatedVulnerabilities":[{"id":"CVE-2026-124864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124864","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124864","date":"2026-11-12","epss":0.00397,"percentile":0.34404}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2075976","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124864","description":"Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117921","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117921","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117921","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117921","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117921"},"relatedVulnerabilities":[{"id":"CVE-2026-117921","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117921","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117921","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079687","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117921","description":"Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124857","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124857","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124857","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124857","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124857"},"relatedVulnerabilities":[{"id":"CVE-2026-124857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124857","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124857","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2073695","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124857","description":"Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124858","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124858","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124858","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124858","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124858"},"relatedVulnerabilities":[{"id":"CVE-2026-124858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124858","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124858","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2074172","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124858","description":"Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124865","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124865","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124865","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124865","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124865"},"relatedVulnerabilities":[{"id":"CVE-2026-124865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124865","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124865","date":"2026-11-12","epss":0.00397,"percentile":0.34403}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076414","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124865","description":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117918","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117918","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117918","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117918","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117918"},"relatedVulnerabilities":[{"id":"CVE-2026-117918","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117918","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117918","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079676","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117918","description":"Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117919","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117919","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117919","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117919","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117919"},"relatedVulnerabilities":[{"id":"CVE-2026-117919","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117919","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117919","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079677","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117919","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117929","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117929","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117929","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117929","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117929"},"relatedVulnerabilities":[{"id":"CVE-2026-117929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117929","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117929","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081549","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117929","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117949","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117949","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117949","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117949","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117949"},"relatedVulnerabilities":[{"id":"CVE-2026-117949","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117949","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117949","date":"2026-11-12","epss":0.00397,"percentile":0.34402}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082118","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117949","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117884","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117884","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117884","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117884","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117884"},"relatedVulnerabilities":[{"id":"CVE-2026-117884","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117884","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117884","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076410","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117884","description":"Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117943","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117943","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117943","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117943","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117943"},"relatedVulnerabilities":[{"id":"CVE-2026-117943","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117943","cwe":"CWE-415","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117943","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082061","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117943","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124860","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124860","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124860","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124860","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124860"},"relatedVulnerabilities":[{"id":"CVE-2026-124860","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124860","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124860","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2074194","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124860","description":"Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124863","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124863","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124863","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124863","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124863"},"relatedVulnerabilities":[{"id":"CVE-2026-124863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124863","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124863","date":"2026-11-12","epss":0.00397,"percentile":0.34401}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2075975","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124863","description":"Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117883","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117883","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117883","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117883","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117883"},"relatedVulnerabilities":[{"id":"CVE-2026-117883","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117883","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117883","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076271","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117883","description":"Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117899","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117899","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117899","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117899"},"relatedVulnerabilities":[{"id":"CVE-2026-117899","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117899","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117899","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079046","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117899","description":"Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117900","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117900","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117900","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117900","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117900"},"relatedVulnerabilities":[{"id":"CVE-2026-117900","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117900","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117900","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079053","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117900","description":"Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117901","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117901","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117901","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117901","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117901"},"relatedVulnerabilities":[{"id":"CVE-2026-117901","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117901","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117901","date":"2026-11-12","epss":0.00397,"percentile":0.344}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079054","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117901","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117869","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117869","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117869","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117869","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117869"},"relatedVulnerabilities":[{"id":"CVE-2026-117869","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117869","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117869","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2068362","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117869","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117872","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117872","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117872","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117872","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117872"},"relatedVulnerabilities":[{"id":"CVE-2026-117872","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117872","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117872","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2068410","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117872","description":"Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117887","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117887","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117887"},"relatedVulnerabilities":[{"id":"CVE-2026-117887","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117887","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117887","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2077385","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117887","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117930","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117930","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117930","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117930","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117930"},"relatedVulnerabilities":[{"id":"CVE-2026-117930","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117930","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117930","date":"2026-11-12","epss":0.00397,"percentile":0.34399}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081953","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117930","description":"Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117881","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117881","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117881","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117881","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117881"},"relatedVulnerabilities":[{"id":"CVE-2026-117881","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117881","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117881","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076267","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117881","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117931","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117931","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117931","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117931","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117931"},"relatedVulnerabilities":[{"id":"CVE-2026-117931","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117931","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117931","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081969","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117931","description":"Use-after-free in the DOM: Events component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124877","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124877","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124877","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124877","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124877"},"relatedVulnerabilities":[{"id":"CVE-2026-124877","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124877","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124877","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081939","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124877","description":"Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124880","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124880","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124880","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124880","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124880"},"relatedVulnerabilities":[{"id":"CVE-2026-124880","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124880","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124880","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081966","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124880","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124885","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124885","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124885","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124885","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124885"},"relatedVulnerabilities":[{"id":"CVE-2026-124885","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124885","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124885","date":"2026-11-12","epss":0.00397,"percentile":0.34398}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082006","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124885","description":"Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117936","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117936","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117936","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117936"},"relatedVulnerabilities":[{"id":"CVE-2026-117936","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117936","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117936","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082001","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117936","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117941","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117941","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117941","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117941","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117941"},"relatedVulnerabilities":[{"id":"CVE-2026-117941","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117941","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117941","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082044","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117941","description":"Use-after-free in the DOM: CSS Object Model component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117974","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117974","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117974","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117974","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117974"},"relatedVulnerabilities":[{"id":"CVE-2026-117974","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117974","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117974","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076705","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117974","description":"Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124899","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124899","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124899","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124899","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124899"},"relatedVulnerabilities":[{"id":"CVE-2026-124899","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124899","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124899","date":"2026-11-12","epss":0.00397,"percentile":0.34397}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082451","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-126/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124899","description":"Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117951","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117951","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117951","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117951","date":"2026-11-12","epss":0.00397,"percentile":0.34396}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117951"},"relatedVulnerabilities":[{"id":"CVE-2026-117951","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117951","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117951","date":"2026-11-12","epss":0.00397,"percentile":0.34396}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082130","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117951","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117954","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117954","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117954","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117954","date":"2026-11-12","epss":0.00397,"percentile":0.34396}],"risk":0.19849999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117954"},"relatedVulnerabilities":[{"id":"CVE-2026-117954","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117954","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117954","date":"2026-11-12","epss":0.00397,"percentile":0.34396}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082450","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117954","description":"Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100773","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-100773","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100773","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-100773","date":"2026-11-12","epss":0.00396,"percentile":0.34298}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100773"},"relatedVulnerabilities":[{"id":"CVE-2026-100773","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100773","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-100773","date":"2026-11-12","epss":0.00396,"percentile":0.34298}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2068346","https://www.mozilla.org/security/advisories/mfsa2026-100/","https://www.mozilla.org/security/advisories/mfsa2026-101/","https://www.mozilla.org/security/advisories/mfsa2026-102/","https://www.mozilla.org/security/advisories/mfsa2026-103/","https://www.mozilla.org/security/advisories/mfsa2026-97/","https://www.mozilla.org/security/advisories/mfsa2026-98/","https://www.mozilla.org/security/advisories/mfsa2026-99/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100773","description":"Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-100791","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100791","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-100791","date":"2026-11-12","epss":0.00396,"percentile":0.34298}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100791"},"relatedVulnerabilities":[{"id":"CVE-2026-100791","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100791","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-100791","date":"2026-11-12","epss":0.00396,"percentile":0.34298}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2072433","https://www.mozilla.org/security/advisories/mfsa2026-100/","https://www.mozilla.org/security/advisories/mfsa2026-101/","https://www.mozilla.org/security/advisories/mfsa2026-102/","https://www.mozilla.org/security/advisories/mfsa2026-103/","https://www.mozilla.org/security/advisories/mfsa2026-97/","https://www.mozilla.org/security/advisories/mfsa2026-98/","https://www.mozilla.org/security/advisories/mfsa2026-99/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100791","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74969","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74969","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74969","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74969","date":"2026-11-12","epss":0.00396,"percentile":0.34298}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74969"},"relatedVulnerabilities":[{"id":"CVE-2026-74969","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74969","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74969","date":"2026-11-12","epss":0.00396,"percentile":0.34298}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2056065","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-75/","https://www.mozilla.org/security/advisories/mfsa2026-76/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-79/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74969","description":"Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12289","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12289","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12289","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12289","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12289","date":"2026-11-12","epss":0.00395,"percentile":0.34209}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12289"},"relatedVulnerabilities":[{"id":"CVE-2026-12289","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12289","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12289","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12289","date":"2026-11-12","epss":0.00395,"percentile":0.34209}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2023443","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-59/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12289","https://bugzilla.redhat.com/show_bug.cgi?id=2489229","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12289.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12289","description":"Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-2780","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-2780","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-2780","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2780","date":"2026-11-12","epss":0.00395,"percentile":0.34185}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-2780"},"relatedVulnerabilities":[{"id":"CVE-2026-2780","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-2780","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-2780","date":"2026-11-12","epss":0.00395,"percentile":0.34185}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2007829","https://www.mozilla.org/security/advisories/mfsa2026-13/","https://www.mozilla.org/security/advisories/mfsa2026-15/","https://www.mozilla.org/security/advisories/mfsa2026-16/","https://www.mozilla.org/security/advisories/mfsa2026-17/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2780","description":"Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16352","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16352","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16352","date":"2026-11-12","epss":0.00394,"percentile":0.34075}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16352"},"relatedVulnerabilities":[{"id":"CVE-2026-16352","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16352","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16352","date":"2026-11-12","epss":0.00394,"percentile":0.34075}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2046416","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16352","description":"Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16351","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16351","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16351","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16351","date":"2026-11-12","epss":0.00394,"percentile":0.34074}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16351"},"relatedVulnerabilities":[{"id":"CVE-2026-16351","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16351","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16351","date":"2026-11-12","epss":0.00394,"percentile":0.34074}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2045468","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16351","description":"Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16356","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16356","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16356","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16356","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16356","date":"2026-11-12","epss":0.00394,"percentile":0.34074}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16356"},"relatedVulnerabilities":[{"id":"CVE-2026-16356","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16356","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-16356","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16356","date":"2026-11-12","epss":0.00394,"percentile":0.34074}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2052562","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-69/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16356","description":"Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12296","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12296","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12296","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12296","cwe":"CWE-403","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12296","date":"2026-11-12","epss":0.00393,"percentile":0.33953}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12296"},"relatedVulnerabilities":[{"id":"CVE-2026-12296","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12296","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12296","cwe":"CWE-403","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12296","date":"2026-11-12","epss":0.00393,"percentile":0.33953}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2040515","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12296","https://bugzilla.redhat.com/show_bug.cgi?id=2489232","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12296.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12296","description":"Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12297","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12297","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12297","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12297","cwe":"CWE-653","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12297","date":"2026-11-12","epss":0.00393,"percentile":0.33953}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12297"},"relatedVulnerabilities":[{"id":"CVE-2026-12297","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12297","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12297","cwe":"CWE-653","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12297","date":"2026-11-12","epss":0.00393,"percentile":0.33953}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041610","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-59/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12297","https://bugzilla.redhat.com/show_bug.cgi?id=2489235","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12297.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12297","description":"Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12295","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12295","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12295","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12295","cwe":"CWE-653","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12295","date":"2026-11-12","epss":0.00393,"percentile":0.33952}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12295"},"relatedVulnerabilities":[{"id":"CVE-2026-12295","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12295","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12295","cwe":"CWE-653","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12295","date":"2026-11-12","epss":0.00393,"percentile":0.33952}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2040160","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-59/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12295","https://bugzilla.redhat.com/show_bug.cgi?id=2489226","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12295.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12295","description":"Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124887","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124887","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124887","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124887","date":"2026-11-12","epss":0.00391,"percentile":0.33707}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124887"},"relatedVulnerabilities":[{"id":"CVE-2026-124887","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124887","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124887","date":"2026-11-12","epss":0.00391,"percentile":0.33707}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082024","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124887","description":"Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117956","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117956","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117956","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117956","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117956"},"relatedVulnerabilities":[{"id":"CVE-2026-117956","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117956","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117956","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2058659","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117956","description":"Invalid pointer in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117975","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117975","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117975","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117975","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117975"},"relatedVulnerabilities":[{"id":"CVE-2026-117975","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117975","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117975","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076714","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117975","description":"Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124888","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124888","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124888","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124888","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124888"},"relatedVulnerabilities":[{"id":"CVE-2026-124888","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124888","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124888","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082025","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124888","description":"Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124891","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124891","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124891","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124891","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124891"},"relatedVulnerabilities":[{"id":"CVE-2026-124891","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124891","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124891","date":"2026-11-12","epss":0.00391,"percentile":0.33706}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082075","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124891","description":"Incorrect boundary conditions in the DOM: Selection component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117962","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117962","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117962"},"relatedVulnerabilities":[{"id":"CVE-2026-117962","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117962","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117962","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2072411","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117962","description":"Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117990","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117990","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117990","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117990"},"relatedVulnerabilities":[{"id":"CVE-2026-117990","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117990","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117990","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079501","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117990","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124856","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124856","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124856","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124856","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124856"},"relatedVulnerabilities":[{"id":"CVE-2026-124856","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124856","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124856","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2072437","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124856","description":"Incorrect boundary conditions in the Networking: HTTP component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124868","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124868","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124868","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124868","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124868"},"relatedVulnerabilities":[{"id":"CVE-2026-124868","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124868","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124868","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079169","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124868","description":"Incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124870","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124870","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124870","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124870","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124870"},"relatedVulnerabilities":[{"id":"CVE-2026-124870","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124870","cwe":"CWE-120","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124870","date":"2026-11-12","epss":0.00391,"percentile":0.33705}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079466","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124870","description":"Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117861","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117861","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117861"},"relatedVulnerabilities":[{"id":"CVE-2026-117861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117861","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117861","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2053240","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117861","description":"Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117864","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117864","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117864","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117864","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117864"},"relatedVulnerabilities":[{"id":"CVE-2026-117864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117864","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117864","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2058614","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117864","description":"Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117984","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117984","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117984","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117984","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117984"},"relatedVulnerabilities":[{"id":"CVE-2026-117984","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117984","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117984","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078981","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117984","description":"Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117988","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117988","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117988"},"relatedVulnerabilities":[{"id":"CVE-2026-117988","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117988","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117988","date":"2026-11-12","epss":0.00391,"percentile":0.33704}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079072","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117988","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117969","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117969","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117969","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117969","date":"2026-11-12","epss":0.00391,"percentile":0.33703}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117969"},"relatedVulnerabilities":[{"id":"CVE-2026-117969","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117969","cwe":"CWE-824","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117969","date":"2026-11-12","epss":0.00391,"percentile":0.33703}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2075990","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117969","description":"Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117991","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117991","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117991","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117991","date":"2026-11-12","epss":0.00391,"percentile":0.33703}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117991"},"relatedVulnerabilities":[{"id":"CVE-2026-117991","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117991","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117991","date":"2026-11-12","epss":0.00391,"percentile":0.33703}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079686","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117991","description":"Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117993","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117993","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117993","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117993","date":"2026-11-12","epss":0.00391,"percentile":0.33703}],"risk":0.1955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117993"},"relatedVulnerabilities":[{"id":"CVE-2026-117993","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117993","cwe":"CWE-190","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117993","date":"2026-11-12","epss":0.00391,"percentile":0.33703}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2080581","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117993","description":"Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117863","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117863","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117863","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117863","date":"2026-11-12","epss":0.0039,"percentile":0.33609}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117863"},"relatedVulnerabilities":[{"id":"CVE-2026-117863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117863","cwe":"CWE-908","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117863","date":"2026-11-12","epss":0.0039,"percentile":0.33609}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2056783","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117863","description":"Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117992","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117992","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117992","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117992","date":"2026-11-12","epss":0.0039,"percentile":0.33608}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117992"},"relatedVulnerabilities":[{"id":"CVE-2026-117992","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117992","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117992","date":"2026-11-12","epss":0.0039,"percentile":0.33608}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079709","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117992","description":"Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6772","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6772","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6772","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6772","date":"2026-11-12","epss":0.0039,"percentile":0.33608}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6772"},"relatedVulnerabilities":[{"id":"CVE-2026-6772","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6772","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-6772","date":"2026-11-12","epss":0.0039,"percentile":0.33608}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2026089","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-31/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6772","description":"Incorrect boundary conditions in the Libraries component in NSS. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-8386","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-8386","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-8386","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8386","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8386","date":"2026-11-12","epss":0.00388,"percentile":0.33422}],"risk":0.194,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-8386"},"relatedVulnerabilities":[{"id":"CVE-2024-8386","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-8386","cwe":"CWE-601","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-8386","cwe":"CWE-290","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-8386","date":"2026-11-12","epss":0.00388,"percentile":0.33422}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1907032","https://bugzilla.mozilla.org/show_bug.cgi?id=1909163","https://bugzilla.mozilla.org/show_bug.cgi?id=1909529","https://www.mozilla.org/security/advisories/mfsa2024-39/","https://www.mozilla.org/security/advisories/mfsa2024-40/","https://www.mozilla.org/security/advisories/mfsa2024-43/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-8386","description":"If a site had been granted the permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack. This vulnerability affects Firefox < 130, Firefox ESR < 128.2, and Thunderbird < 128.2."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16368","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16368","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16368","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16368","date":"2026-11-12","epss":0.00388,"percentile":0.33383}],"risk":0.194,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16368"},"relatedVulnerabilities":[{"id":"CVE-2026-16368","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16368","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16368","date":"2026-11-12","epss":0.00388,"percentile":0.33383}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2051015","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16368","description":"Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1014","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1014","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1014","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1014","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1014","date":"2026-11-12","epss":0.00388,"percentile":0.33364}],"risk":0.194,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1014"},"relatedVulnerabilities":[{"id":"CVE-2025-1014","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1014","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-1014","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-1014","date":"2026-11-12","epss":0.00388,"percentile":0.33364}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1940804","https://www.mozilla.org/security/advisories/mfsa2025-07/","https://www.mozilla.org/security/advisories/mfsa2025-09/","https://www.mozilla.org/security/advisories/mfsa2025-10/","https://www.mozilla.org/security/advisories/mfsa2025-11/","https://lists.debian.org/debian-lts-announce/2025/02/msg00006.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1014","description":"Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed. This vulnerability was fixed in Firefox 135, Firefox ESR 128.7, Thunderbird 128.7, and Thunderbird 135."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6754","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6754","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6754","date":"2026-11-12","epss":0.00387,"percentile":0.33285}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6754"},"relatedVulnerabilities":[{"id":"CVE-2026-6754","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6754","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-6754","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-6754","date":"2026-11-12","epss":0.00387,"percentile":0.33285}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2027541","https://www.mozilla.org/security/advisories/mfsa2026-30/","https://www.mozilla.org/security/advisories/mfsa2026-31/","https://www.mozilla.org/security/advisories/mfsa2026-32/","https://www.mozilla.org/security/advisories/mfsa2026-33/","https://www.mozilla.org/security/advisories/mfsa2026-34/","https://access.redhat.com/errata/RHSA-2026:10757","https://access.redhat.com/errata/RHSA-2026:10766","https://access.redhat.com/errata/RHSA-2026:10767","https://access.redhat.com/errata/RHSA-2026:12285","https://access.redhat.com/errata/RHSA-2026:13537","https://access.redhat.com/errata/RHSA-2026:15892","https://access.redhat.com/errata/RHSA-2026:17477","https://access.redhat.com/errata/RHSA-2026:17687","https://access.redhat.com/errata/RHSA-2026:17688","https://access.redhat.com/errata/RHSA-2026:17689","https://access.redhat.com/errata/RHSA-2026:17690","https://access.redhat.com/errata/RHSA-2026:19041","https://access.redhat.com/errata/RHSA-2026:19131","https://access.redhat.com/errata/RHSA-2026:19201","https://access.redhat.com/errata/RHSA-2026:19348","https://access.redhat.com/errata/RHSA-2026:19461","https://access.redhat.com/errata/RHSA-2026:19462","https://access.redhat.com/errata/RHSA-2026:19463","https://access.redhat.com/errata/RHSA-2026:19464","https://access.redhat.com/errata/RHSA-2026:19465","https://access.redhat.com/errata/RHSA-2026:19466","https://access.redhat.com/errata/RHSA-2026:19467","https://access.redhat.com/errata/RHSA-2026:19468","https://access.redhat.com/errata/RHSA-2026:19469","https://access.redhat.com/errata/RHSA-2026:19542","https://access.redhat.com/errata/RHSA-2026:19655","https://access.redhat.com/errata/RHSA-2026:19704","https://access.redhat.com/security/cve/CVE-2026-6754","https://bugzilla.redhat.com/show_bug.cgi?id=2460075","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6754.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6754","description":"Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16377","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16377","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16377","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16377","date":"2026-11-12","epss":0.00387,"percentile":0.33251}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16377"},"relatedVulnerabilities":[{"id":"CVE-2026-16377","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16377","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16377","date":"2026-11-12","epss":0.00387,"percentile":0.33251}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2037770","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16377","description":"Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-16383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-16383","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16383","date":"2026-11-12","epss":0.00387,"percentile":0.3325}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-16383"},"relatedVulnerabilities":[{"id":"CVE-2026-16383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16383","cwe":"CWE-693","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-16383","date":"2026-11-12","epss":0.00387,"percentile":0.3325}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2041902","https://www.mozilla.org/security/advisories/mfsa2026-68/","https://www.mozilla.org/security/advisories/mfsa2026-70/","https://www.mozilla.org/security/advisories/mfsa2026-71/","https://www.mozilla.org/security/advisories/mfsa2026-72/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16383","description":"Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8955","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8955","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8955","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8955","date":"2026-11-12","epss":0.00386,"percentile":0.33127}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8955"},"relatedVulnerabilities":[{"id":"CVE-2026-8955","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8955","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8955","date":"2026-11-12","epss":0.00386,"percentile":0.33127}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2031064","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8955","description":"Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8957","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8957","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8957","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8957","date":"2026-11-12","epss":0.00386,"percentile":0.33127}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8957"},"relatedVulnerabilities":[{"id":"CVE-2026-8957","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8957","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-8957","date":"2026-11-12","epss":0.00386,"percentile":0.33127}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2033850","https://www.mozilla.org/security/advisories/mfsa2026-46/","https://www.mozilla.org/security/advisories/mfsa2026-48/","https://www.mozilla.org/security/advisories/mfsa2026-50/","https://www.mozilla.org/security/advisories/mfsa2026-51/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8957","description":"Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-7530","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-7530","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-7530","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7530","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7530","date":"2026-11-12","epss":0.00384,"percentile":0.32988}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-7530"},"relatedVulnerabilities":[{"id":"CVE-2024-7530","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-7530","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2024-7530","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-7530","date":"2026-11-12","epss":0.00384,"percentile":0.32988}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1904011","https://www.mozilla.org/security/advisories/mfsa2024-33/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-7530","description":"Incorrect garbage collection interaction could have led to a use-after-free. This vulnerability affects Firefox < 129."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13021","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13021","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13021","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13021","date":"2026-11-12","epss":0.00384,"percentile":0.3294}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13021"},"relatedVulnerabilities":[{"id":"CVE-2025-13021","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13021","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13021","date":"2026-11-12","epss":0.00384,"percentile":0.3294}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1986431","https://www.mozilla.org/security/advisories/mfsa2025-87/","https://www.mozilla.org/security/advisories/mfsa2025-90/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13021","description":"Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13023","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13023","date":"2026-11-12","epss":0.00384,"percentile":0.3294}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13023"},"relatedVulnerabilities":[{"id":"CVE-2025-13023","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13023","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13023","date":"2026-11-12","epss":0.00384,"percentile":0.3294}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1992032","https://www.mozilla.org/security/advisories/mfsa2025-87/","https://www.mozilla.org/security/advisories/mfsa2025-90/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13023","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13026","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13026","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13026","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13026","date":"2026-11-12","epss":0.00384,"percentile":0.3294}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13026"},"relatedVulnerabilities":[{"id":"CVE-2025-13026","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13026","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13026","date":"2026-11-12","epss":0.00384,"percentile":0.3294}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1994441","https://www.mozilla.org/security/advisories/mfsa2025-87/","https://www.mozilla.org/security/advisories/mfsa2025-90/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13026","description":"Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13022","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13022","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13022","date":"2026-11-12","epss":0.00384,"percentile":0.32939}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13022"},"relatedVulnerabilities":[{"id":"CVE-2025-13022","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13022","cwe":"CWE-703","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13022","date":"2026-11-12","epss":0.00384,"percentile":0.32939}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1988488","https://www.mozilla.org/security/advisories/mfsa2025-87/","https://www.mozilla.org/security/advisories/mfsa2025-90/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13022","description":"Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and Thunderbird 145."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13024","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13024","cwe":"CWE-733","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13024","date":"2026-11-12","epss":0.00384,"percentile":0.32939}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13024"},"relatedVulnerabilities":[{"id":"CVE-2025-13024","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13024","cwe":"CWE-733","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-13024","date":"2026-11-12","epss":0.00384,"percentile":0.32939}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=1992902","https://www.mozilla.org/security/advisories/mfsa2025-87/","https://www.mozilla.org/security/advisories/mfsa2025-90/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13024","description":"JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 145 and Thunderbird 145."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92063","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-92063","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92063","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92063","date":"2026-11-12","epss":0.00384,"percentile":0.32898}],"risk":0.192,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92063"},"relatedVulnerabilities":[{"id":"CVE-2026-92063","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92063","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92063","date":"2026-11-12","epss":0.00384,"percentile":0.32898}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2055737","https://www.mozilla.org/security/advisories/mfsa2026-90/","https://www.mozilla.org/security/advisories/mfsa2026-94/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92063","description":"Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120572","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-120572","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-120572","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-120572","date":"2026-11-12","epss":0.00383,"percentile":0.32883}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-120572"},"relatedVulnerabilities":[{"id":"CVE-2026-120572","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120572","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-120572","date":"2026-11-12","epss":0.00383,"percentile":0.32883}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079035","https://www.mozilla.org/security/advisories/mfsa2026-123/","https://www.mozilla.org/security/advisories/mfsa2026-128/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120572","description":"Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1 and Thunderbird 160."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117886","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117886","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117886"},"relatedVulnerabilities":[{"id":"CVE-2026-117886","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117886","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117886","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2077162","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117886","description":"Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117926","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117926","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117926","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117926","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117926"},"relatedVulnerabilities":[{"id":"CVE-2026-117926","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117926","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117926","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079924","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117926","description":"Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117952","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117952","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117952","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117952","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117952"},"relatedVulnerabilities":[{"id":"CVE-2026-117952","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117952","cwe":"CWE-457","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117952","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082139","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117952","description":"Uninitialized memory in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117978","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117978","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117978","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117978","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117978"},"relatedVulnerabilities":[{"id":"CVE-2026-117978","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117978","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117978","date":"2026-11-12","epss":0.00383,"percentile":0.32876}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2077730","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117978","description":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117873","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117873","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117873","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117873","date":"2026-11-12","epss":0.00383,"percentile":0.32875}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117873"},"relatedVulnerabilities":[{"id":"CVE-2026-117873","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117873","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117873","date":"2026-11-12","epss":0.00383,"percentile":0.32875}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2071733","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-119/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117873","description":"Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0886","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-0886","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0886","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0886","date":"2026-11-12","epss":0.00383,"percentile":0.32778}],"risk":0.1915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0886"},"relatedVulnerabilities":[{"id":"CVE-2026-0886","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0886","cwe":"CWE-119","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-0886","date":"2026-11-12","epss":0.00383,"percentile":0.32778}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2005658","https://www.mozilla.org/security/advisories/mfsa2026-01/","https://www.mozilla.org/security/advisories/mfsa2026-02/","https://www.mozilla.org/security/advisories/mfsa2026-03/","https://www.mozilla.org/security/advisories/mfsa2026-04/","https://www.mozilla.org/security/advisories/mfsa2026-05/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0886","description":"Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12291","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12291","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12291","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12291","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12291","date":"2026-11-12","epss":0.00382,"percentile":0.32658}],"risk":0.191,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12291"},"relatedVulnerabilities":[{"id":"CVE-2026-12291","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12291","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-12291","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-12291","date":"2026-11-12","epss":0.00382,"percentile":0.32658}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2036929","https://www.mozilla.org/security/advisories/mfsa2026-57/","https://www.mozilla.org/security/advisories/mfsa2026-58/","https://www.mozilla.org/security/advisories/mfsa2026-59/","https://www.mozilla.org/security/advisories/mfsa2026-60/","https://www.mozilla.org/security/advisories/mfsa2026-61/","https://access.redhat.com/errata/RHSA-2026:27717","https://access.redhat.com/errata/RHSA-2026:27733","https://access.redhat.com/errata/RHSA-2026:27734","https://access.redhat.com/errata/RHSA-2026:29940","https://access.redhat.com/errata/RHSA-2026:30846","https://access.redhat.com/errata/RHSA-2026:33445","https://access.redhat.com/errata/RHSA-2026:36100","https://access.redhat.com/errata/RHSA-2026:36101","https://access.redhat.com/errata/RHSA-2026:36102","https://access.redhat.com/errata/RHSA-2026:36103","https://access.redhat.com/errata/RHSA-2026:37210","https://access.redhat.com/errata/RHSA-2026:37391","https://access.redhat.com/errata/RHSA-2026:38506","https://access.redhat.com/errata/RHSA-2026:38750","https://access.redhat.com/errata/RHSA-2026:38751","https://access.redhat.com/errata/RHSA-2026:38753","https://access.redhat.com/errata/RHSA-2026:39011","https://access.redhat.com/errata/RHSA-2026:39141","https://access.redhat.com/errata/RHSA-2026:39142","https://access.redhat.com/errata/RHSA-2026:39428","https://access.redhat.com/errata/RHSA-2026:39706","https://access.redhat.com/security/cve/CVE-2026-12291","https://bugzilla.redhat.com/show_bug.cgi?id=2489244","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12291.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12291","description":"Use-after-free in the Networking: HTTP component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-74978","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-74978","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-74978","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74978","date":"2026-11-12","epss":0.00381,"percentile":0.32576}],"risk":0.1905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-74978"},"relatedVulnerabilities":[{"id":"CVE-2026-74978","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-74978","cwe":"CWE-1021","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-74978","date":"2026-11-12","epss":0.00381,"percentile":0.32576}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2036097","https://www.mozilla.org/security/advisories/mfsa2026-74/","https://www.mozilla.org/security/advisories/mfsa2026-77/","https://www.mozilla.org/security/advisories/mfsa2026-78/","https://www.mozilla.org/security/advisories/mfsa2026-80/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-74978","description":"Clickjacking issue in the Widget component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117964","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117964","date":"2026-11-12","epss":0.0038,"percentile":0.32474}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117964"},"relatedVulnerabilities":[{"id":"CVE-2026-117964","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117964","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117964","date":"2026-11-12","epss":0.0038,"percentile":0.32474}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2074199","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117964","description":"Use-after-free in the Panning and Zooming component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124866","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124866","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124866","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124866","date":"2026-11-12","epss":0.0038,"percentile":0.32474}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124866"},"relatedVulnerabilities":[{"id":"CVE-2026-124866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124866","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124866","date":"2026-11-12","epss":0.0038,"percentile":0.32474}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078993","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124866","description":"Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117972","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117972","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117972","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117972","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117972"},"relatedVulnerabilities":[{"id":"CVE-2026-117972","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117972","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117972","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2076415","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117972","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117989","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117989","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117989","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117989","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117989"},"relatedVulnerabilities":[{"id":"CVE-2026-117989","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117989","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117989","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2079311","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117989","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124883","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124883","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124883","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124883","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124883"},"relatedVulnerabilities":[{"id":"CVE-2026-124883","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124883","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124883","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2081991","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124883","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124897","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124897","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124897","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124897","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124897"},"relatedVulnerabilities":[{"id":"CVE-2026-124897","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124897","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124897","date":"2026-11-12","epss":0.0038,"percentile":0.32473}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082186","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124897","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117983","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117983","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117983","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117983","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117983"},"relatedVulnerabilities":[{"id":"CVE-2026-117983","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117983","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117983","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078904","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117983","description":"Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117994","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117994","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117994","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117994","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117994"},"relatedVulnerabilities":[{"id":"CVE-2026-117994","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117994","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117994","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2080787","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117994","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124862","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124862","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124862","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124862","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124862"},"relatedVulnerabilities":[{"id":"CVE-2026-124862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124862","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124862","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2074220","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124862","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-124892","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-124892","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-124892","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124892","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-124892"},"relatedVulnerabilities":[{"id":"CVE-2026-124892","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-124892","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-124892","date":"2026-11-12","epss":0.0038,"percentile":0.32472}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082083","https://www.mozilla.org/security/advisories/mfsa2026-125/","https://www.mozilla.org/security/advisories/mfsa2026-127/","https://www.mozilla.org/security/advisories/mfsa2026-128/","https://www.mozilla.org/security/advisories/mfsa2026-129/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-124892","description":"Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117953","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117953","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117953","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117953","date":"2026-11-12","epss":0.0038,"percentile":0.32471}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117953"},"relatedVulnerabilities":[{"id":"CVE-2026-117953","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117953","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117953","date":"2026-11-12","epss":0.0038,"percentile":0.32471}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2082199","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117953","description":"Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]},{"artifact":{"id":"5780d19f7b0947bf","cpes":["cpe:2.3:a:libmozjs-115-0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115-0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115_0t64:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs-115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs_115:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs-115-0t64:115.10.0-1:*:*:*:*:*:*:*","cpe:2.3:a:libmozjs:libmozjs_115_0t64:115.10.0-1:*:*:*:*:*:*:*"],"name":"libmozjs-115-0t64","purl":"pkg:deb/ubuntu/libmozjs-115-0t64@115.10.0-1?arch=amd64&distro=ubuntu-24.04&upstream=mozjs115","type":"deb","version":"115.10.0-1","language":"","licenses":["Apache-2.0","BSD-2-clause","BSD-3-clause","BSD-3-clause-ARM","BSD-3-clause-ECMA","BSD-3-clause-Google","BSD-3-clause-Intel","BSD-3-clause-SwapOff","BSD-3-clause-UC","BSD-3-clause-Voidspace","BSD-3-clause-psutil","BSL-1.0","Beerware","CC0-1.0","Expat","GPL-2","GPL-2+","GPL-3","GPL-3+","GPL-some-version","ICU-IBM","ICU-Unicode","ISC","LGPL-2.1","MIT-Lucent","MPL-2.0","NTP","Python","SunPro","Unlicense","Zlib","aclocal-public-domain","nspr-public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmozjs-115-0t64/copyright","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/usr/share/doc/libmozjs-115-0t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","layerID":"sha256:866a8f524885502a0b495ada38307a59c44a6b3b2613b21a1355a5a54c0acbf9","accessPath":"/var/lib/dpkg/info/libmozjs-115-0t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mozjs115"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mozjs115","version":"115.10.0-1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-117985","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-117985","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117985","date":"2026-11-12","epss":0.0038,"percentile":0.32471}],"risk":0.19,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-117985"},"relatedVulnerabilities":[{"id":"CVE-2026-117985","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.6,"impactScore":6.1,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117985","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-117985","date":"2026-11-12","epss":0.0038,"percentile":0.32471}],"urls":["https://bugzilla.mozilla.org/show_bug.cgi?id=2078982","https://www.mozilla.org/security/advisories/mfsa2026-118/","https://www.mozilla.org/security/advisories/mfsa2026-120/","https://www.mozilla.org/security/advisories/mfsa2026-121/","https://www.mozilla.org/security/advisories/mfsa2026-122/"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117985","description":"Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6."}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T06:51:54.582Z","grype_db_version":"2026-11-13T15:40:34.000Z"}