The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and     Firefox 157. (CVE-2026-100817)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-913130e4f5 advisory.

    - Updated to latest upstream (157.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory.

  - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox     ESR 153.4 and Firefox 157. (CVE-2026-100831)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-08d4e87b00 advisory.

    - Updated to latest upstream (157.0)

    ----

    - Update to latest upstream

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-97 advisory.

  - Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and     Firefox 157. (CVE-2026-100824)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-97 advisory.

  - Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4 and     Firefox 157. (CVE-2026-100824)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

  - Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4,     Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 157.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-101 advisory.

  - Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox     ESR 153.4 and Firefox 157. (CVE-2026-100831)

  - Sandbox escape due to incorrect boundary conditions in the XPCOM component. This vulnerability was fixed     in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100819)

  - An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or     equal to 2GB in size. (CVE-2026-103500)

  - Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in     Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100756)

  - Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157,     Firefox ESR 115.42, and Firefox ESR 140.17. (CVE-2026-100757)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-06aa513df8 advisory.

    - Updated to latest upstream (157.0)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
358338	Linux Distros Unpatched Vulnerability : CVE-2026-100817	Nessus	Misc.	10/1/2026	10/2/2026	medium
362841	Fedora 44 : firefox (2026-913130e4f5)	Nessus	Fedora Local Security Checks	10/3/2026	10/3/2026	critical
353286	Mozilla Thunderbird < 157.0	Nessus	Windows	9/30/2026	10/19/2026	medium
362814	Fedora 43 : firefox (2026-08d4e87b00)	Nessus	Fedora Local Security Checks	10/3/2026	10/3/2026	critical
351120	Mozilla Firefox < 157.0	Nessus	MacOS X Local Security Checks	9/29/2026	10/5/2026	critical
351119	Mozilla Firefox < 157.0	Nessus	Windows	9/29/2026	10/5/2026	critical
353287	Mozilla Thunderbird < 157.0	Nessus	MacOS X Local Security Checks	9/30/2026	10/19/2026	medium
362715	Fedora 45 : firefox (2026-06aa513df8)	Nessus	Fedora Local Security Checks	10/2/2026	10/2/2026	critical

Detections

Analytics

Plugins Search

medium

critical

medium

critical

critical

critical

medium

critical