The version of Firefox installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.43.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-113 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary     Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the     prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a     potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 153.5.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-115 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-500450 advisory.

    [2025.2.80_v9.0.305-91.0.1]
    - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox     158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.
    (CVE-2026-113470)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.5.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-112 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.43.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-113 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 153.5.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2026-112 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-500451 advisory.

    [2025.2.80_v9.0.305-102.0.1]
    - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6573 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6573-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     October 21, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : firefox-esr     CVE ID         : CVE-2026-113470

    This update blocks compromised intermediate certificates issued by the     eMudhra CA.

    Most users will have these certs already blocked by the OneCRL feature     provided by Firefox. This update blocks the certificates also for     installations which have RemoteSettings disabled or which are unable to     connect to the revocation backend service due to network constraints.

    For the stable distribution (trixie), this problem has been fixed in     version 153.5.1esr-1~deb13u1.

    We recommend that you upgrade your firefox-esr packages.

    For the detailed security status of firefox-esr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/firefox-esr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-500449 advisory.

    [2025.2.80_v9.0.304-80.2.0.1]
    - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Thunderbird installed on the remote Windows host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-114 advisory.

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's     AutoDiscover service over plain HTTP. Due to a bug, that unencrypted request included the credentials the     user had entered, allowing a network attacker to obtain the user's password. (CVE-2026-113866)

  - Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from     incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request     that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would     then process as if sent by the user. This could be used to send messages or change contact and     subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's     chat feature with XMPP accounts. (CVE-2026-113867)

  - When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's     challenge was valid base64. A malicious server could send a challenge that caused Thunderbird to include     uninitialized heap memory in its NTLM response, disclosing that memory to the server. A challenge     consisting only of base64 padding also caused an out-of-bounds read, crashing Thunderbird. This affected     accounts configured to use NTLM or GSSAPI authentication. The uninitialized memory disclosure only     affected NTLM. (CVE-2026-113868)

  - When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary     Password) while decrypting an S/MIME message, the message load could finish or be cancelled while the     prompt was open. This freed the message decoder while it was still in use, causing a use-after-free and a     potentially exploitable crash. (CVE-2026-113869)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 158.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-111 advisory.

  - Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113401)

  - Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was     distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block     list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by     policy or otherwise unavailable in the user's network environment. (CVE-2026-113470)

  - Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1.
    (CVE-2026-113400)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
367827	Mozilla Firefox < 158.0.1	Nessus	Windows	10/20/2026	10/21/2026	high
369495	Mozilla Thunderbird < 153.5.1	Nessus	MacOS X Local Security Checks	10/21/2026	10/21/2026	medium
367825	Mozilla Firefox ESR < 115.43.1	Nessus	Windows	10/20/2026	10/20/2026	high
369076	Mozilla Thunderbird < 158.0.1	Nessus	MacOS X Local Security Checks	10/21/2026	10/21/2026	medium
369496	Mozilla Thunderbird < 153.5.1	Nessus	Windows	10/21/2026	10/21/2026	medium
369041	Oracle Linux 9 : ca-certificates (ELSA-2026-500450)	Nessus	Oracle Linux Local Security Checks	10/21/2026	10/21/2026	medium
369050	Linux Distros Unpatched Vulnerability : CVE-2026-113470	Nessus	Misc.	10/21/2026	10/21/2026	medium
367826	Mozilla Firefox ESR < 153.5.1	Nessus	MacOS X Local Security Checks	10/20/2026	10/20/2026	high
367829	Mozilla Firefox ESR < 115.43.1	Nessus	MacOS X Local Security Checks	10/20/2026	10/20/2026	high
367830	Mozilla Firefox ESR < 153.5.1	Nessus	Windows	10/20/2026	10/20/2026	high
369044	Oracle Linux 10 : ca-certificates (ELSA-2026-500451)	Nessus	Oracle Linux Local Security Checks	10/21/2026	10/21/2026	medium
369497	Debian dsa-6573 : firefox-esr - security update	Nessus	Debian Local Security Checks	10/21/2026	10/21/2026	medium
369046	Oracle Linux 8 : ca-certificates (ELSA-2026-500449)	Nessus	Oracle Linux Local Security Checks	10/21/2026	10/21/2026	medium
369077	Mozilla Thunderbird < 158.0.1	Nessus	Windows	10/21/2026	10/21/2026	medium
367828	Mozilla Firefox < 158.0.1	Nessus	MacOS X Local Security Checks	10/20/2026	10/21/2026	high

Detections

Analytics

Plugins Search

high

medium

high

medium

medium

medium

medium

high

high

high

medium

medium

medium

medium

high