Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, Thunderbird 115.20, and Thunderbird 128.7CVE-2025-1016Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreCertificate length was not properly checkedCVE-2025-1014Fix available8.8 High
- mozilla firefox, thunderbird +1 morePotential opening of private browsing tabs in normal browsing windowsCVE-2025-1013Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free during concurrent delazificationCVE-2025-1012Fix available7.5 High
- mozilla firefox, thunderbird +1 moreA bug in WebAssembly code generation could result in a crashCVE-2025-1011Fix available8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in Custom HighlightCVE-2025-1010Fix available8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in XSLTCVE-2025-1009Fix available9.8 Critical
- marco castelluccio web pushWordPress Web Push plugin <= 1.4.0 - CSRF to Stored XSS vulnerabilityCVE-2025-237207.1 High
- mozilla firefox, firefox for ios +1 moreAddress bar spoofing on iOS using long hostnamesCVE-2025-231096.5 Medium
- mozilla firefox, firefox for ios +1 moreFirefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URICVE-2025-231084.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134 and Thunderbird 134CVE-2025-0247Fix availableEPSS 10.7%9.8 Critical
- mozilla firefoxAddress bar spoofing using an invalid protocol scheme on Firefox for AndroidCVE-2025-02466.5 Medium
- mozilla firefoxLock screen setting bypass in Firefox Focus for AndroidCVE-2025-02453.3 Low
- mozilla firefoxAddress bar spoofing using an invalid protocol scheme on Firefox for AndroidCVE-2025-02445.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6CVE-2025-0243Fix available5.1 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6CVE-2025-0242Fix availableEPSS 14.7%6.5 Medium
- mozilla firefox, thunderbird +1 moreMemory corruption when using JavaScript Text SegmentationCVE-2025-0241Fix available7.7 High
- mozilla firefox, thunderbird +1 moreCompartment mismatch when parsing JavaScript JSON moduleCVE-2025-0240Fix available4.0 Medium
- mozilla firefox, thunderbird +1 moreAlt-Svc ALPN validation failure when redirectedCVE-2025-0239Fix available4.0 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free when breaking lines in textCVE-2025-0238Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreWebChannel APIs susceptible to confused deputy attackCVE-2025-0237Fix available5.4 Medium
- mozilla firefox, firefox for ios +1 moreUnder certain circumstances, navigating to a webpage would result in the address missing from the...CVE-2024-539765.4 Medium
- mozilla firefox, firefox for ios +1 moreAccessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in...CVE-2024-539755.4 Medium
- mozilla firefox, thunderbird +1 moreMissing thread synchronization primitives could have led to a data race on members of the...CVE-2024-11708Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of...CVE-2024-11699Fix available8.8 High
- mozilla firefox, thunderbird +1 moreA null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the...CVE-2024-11706Fix available6.5 Medium
- mozilla firefox, thunderbird +1 more`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was...CVE-2024-11705Fix available9.1 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA flaw in handling fullscreen transitions may have inadvertently caused the application to become...CVE-2024-116989.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreA double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an...CVE-2024-11704Fix available9.8 Critical
- mozilla firefox, firefox esr, thunderbird +2 moreWhen handling keypress events, an attacker may have been able to trick a user into bypassing the ...CVE-2024-11697Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreThe application failed to account for exceptions thrown by the `loadManifestFromFile` method...CVE-2024-11696Fix available5.4 Medium
- mozilla firefoxOn Android, Firefox may have inadvertently allowed viewing saved passwords without the required...CVE-2024-117035.7 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreA crafted URL containing Arabic script and whitespace characters could have hidden the true...CVE-2024-11695Fix available5.4 Medium
- mozilla firefox, thunderbird +1 moreCopying sensitive information from Private Browsing tabs on Android, such as passwords, may have...CVE-2024-117027.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreEnhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src`...CVE-2024-11694Fix available6.1 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreThe executable file warning was not presented when downloading .library-ms files.
*Note: This...CVE-2024-11693Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreThe incorrect domain may have been displayed in the address bar during an interrupted navigation...CVE-2024-11701Fix available4.3 Medium
- mozilla firefox, thunderbird +1 moreMalicious websites may have been able to user intent confirmation through tapjacking. This could...CVE-2024-117008.1 High
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could cause a select dropdown to be shown over another tab; this could have led to...CVE-2024-11692Fix available4.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreAn attacker could have caused memory corruption due to a flaw in Apple's GPU driver; this can be...CVE-2024-11691Fix available8.8 High
- mozilla thunderbirdUsing remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. This...CVE-2024-11159Fix available4.3 Medium
- mozilla firefoxA malicious website could have included an iframe with an malformed URI resulting in a non...CVE-2024-10941Fix available6.5 Medium
- mozilla focus for ios, firefox focus +1 moreFocus was incorrectly allowing internal links to utilize the app scheme used for deeplinking,...CVE-2024-104746.5 Medium
- mozilla firefox, thunderbird +1 morePotential race conditions in IndexedDB could have caused memory corruption, leading to a...CVE-2024-10468Fix available5.3 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreMemory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of...CVE-2024-10467Fix available8.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreBy sending a specially crafted push message, a remote server could have hung the parent process,...CVE-2024-10466Fix available7.5 High
- mozilla firefox, firefox esr, thunderbird +2 moreA clipboard "paste" button could persist across tabs which allowed a spoofing attack. This...CVE-2024-10465Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreRepeated writes to history interface attributes could have been used to cause a Denial of Service...CVE-2024-10464Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreVideo frames could have been leaked between origins in some situations. This vulnerability...CVE-2024-10463Fix available6.5 Medium
- mozilla firefox, firefox esr, thunderbird +2 moreTruncation of a long URL could have allowed origin spoofing in a permission prompt. This...CVE-2024-10462Fix available6.5 Medium
- Show moreLoading…