Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saviCheck if you run itEPSS 0.58%Jun 11, 2025
- Critical9.8An integer overflow was present in used by the JavaScript engine.Check if you run itEPSS 0.74%Jun 11, 2025
- High7.8A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.Check if you run itEPSS 0.13%Jun 11, 2025
- Critical9.8Certain canvas operations could have lead to memory corruption.Check if you run itEPSS 0.66%Jun 11, 2025
- High7.3Memory safety bugs present in Firefox 138 and Thunderbird 138.Check if you run itEPSS 0.33%May 27, 2025
- Medium6.5Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks.Check if you run itEPSS 0.30%May 27, 2025
- High7.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.Check if you run itEPSS 0.29%May 27, 2025
- High8.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10.Check if you run itEPSS 0.46%May 27, 2025
- High8.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.Check if you run itEPSS 0.49%May 27, 2025
- Medium5.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page.Check if you run itEPSS 0.27%May 27, 2025
- Medium4.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks.Check if you run itEPSS 0.33%May 27, 2025
- Medium4.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code exeCheck if you run itEPSS 0.21%May 27, 2025
- Medium4.8Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execuCheck if you run itEPSS 0.29%May 27, 2025
- Medium4.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks.Check if you run itEPSS 0.25%May 27, 2025
- High7.5A double-free could have occurred in after a failed allocation when initializing the encoder for WebRTC.Check if you run itEPSS 0.45%May 27, 2025
- Medium4.3Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internCheck if you run itEPSS 0.24%May 21, 2025
- None0.0wrong yearCheck if you run itEPSS 0.00%May 17, 2025
- None0.0wrong yearCheck if you run itEPSS 0.00%May 17, 2025
- High8.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.Check if you run itEPSS 8.67%May 17, 2025
- Critical9.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object.Check if you run itEPSS 9.43%May 17, 2025
- None0.0Duplicate of CVE-2025-4919Check if you run itEPSS 0.00%May 17, 2025
- None0.0Duplicate of CVE-2025-4918Check if you run itEPSS 0.00%May 17, 2025
- Medium6.5It was possible to craft an email that showed a tracking link as an attachment.Check if you run itEPSS 0.39%May 14, 2025
- High8.1Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context.Check if you run itEPSS 0.47%May 14, 2025
- High7.5Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used.Check if you run itEPSS 0.40%May 14, 2025