Skip to contentMozilla vulnerabilities
Newest
- mozilla firefox, thunderbird +1 moreSearch terms persisted in URL barCVE-2025-8039Fix available8.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141CVE-2025-8034Fix available8.8 High
- mozilla firefox, thunderbird +1 moreIncorrect JavaScript state machine for generatorsCVE-2025-8033Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreCSP frame-src was not correctly enforced for pathsCVE-2025-8038Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreXSLT documents could bypass CSPCVE-2025-8032Fix available8.1 High
- mozilla firefox, thunderbird +1 moreIncorrect URL stripping in CSP reportsCVE-2025-8031Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreNameless cookies shadow secure cookiesCVE-2025-8037Fix available9.1 Critical
- mozilla firefox, thunderbird +1 moreDNS rebinding circumvents CORSCVE-2025-8036Fix available8.1 High
- mozilla firefox, thunderbird +1 morePotential user-assisted code execution in “Copy as cURL” commandCVE-2025-8030Fix available8.1 High
- mozilla firefox, thunderbird +1 morejavascript: URLs executed on object and embed tagsCVE-2025-8029Fix available8.1 High
- mozilla firefox, thunderbird +1 moreLarge branch table could lead to truncated instructionCVE-2025-8028Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreJavaScript engine only wrote partial return value to stackCVE-2025-8027Fix available6.5 Medium
- mozilla neqotransport/fc.rs: panic attempting to send MAX_DATA with value larger max varintCVE-2025-67032.3 Low
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 140 and Thunderbird 140CVE-2025-6436Fix available8.1 High
- mozilla firefox, thunderbird +1 moreSave as in Devtools could download files without sanitizing the extensionCVE-2025-6435Fix available8.1 High
- mozilla firefox, thunderbird +1 moreHTTPS-Only exception screen lacked anti-clickjacking delayCVE-2025-6434Fix available4.3 Medium
- mozilla firefox, thunderbird +1 moreWebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificateCVE-2025-6433Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreDNS Requests leaked outside of a configured SOCKS proxyCVE-2025-6432Fix available8.6 High
- mozilla firefoxThe prompt in Firefox for Android that asks before opening a link in an external application could be bypassedCVE-2025-64316.5 Medium
- mozilla firefoxFirefox for Android opened URLs specified in a link querystring parameterCVE-2025-64284.3 Medium
- mozilla firefox, thunderbird +1 moreContent-Disposition header ignored when a file is included in an embed or object tagCVE-2025-6430Fix available6.1 Medium
- mozilla firefox, thunderbird +1 moreconnect-src Content Security Policy restriction could be bypassedCVE-2025-6427Fix available9.1 Critical
- mozilla firefox, thunderbird +1 moreIncorrect parsing of URLs could have allowed embedding of youtube.comCVE-2025-6429Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreNo warning when opening executable terminal files on macOSCVE-2025-6426Fix available8.8 High
- mozilla firefox, thunderbird +1 moreThe WebCompat WebExtension shipped with Firefox exposed a persistent UUIDCVE-2025-6425Fix available4.3 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in FontFaceSetCVE-2025-6424Fix available9.8 Critical
- mozilla thunderbirdUnsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// LinksCVE-2025-5986Fix available6.5 Medium
- mozilla firefoxInteger overflow in OrderedHashTableCVE-2025-497109.8 Critical
- mozilla vpn 2.28.0, vpn +1 moreLocal privilege escalation vulnerability in Mozilla VPN clients for macOS v2.27.0 and below.CVE-2025-56877.8 High
- mozilla firefoxMemory corruption in canvas surfacesCVE-2025-497099.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 139 and Thunderbird 139CVE-2025-5272Fix available7.3 High
- mozilla firefox, thunderbird +1 moreDevtools' preview ignored CSP headersCVE-2025-5271Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreSNI was sometimes unencryptedCVE-2025-5270Fix available7.5 High
- mozilla firefox, thunderbird +1 moreMemory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11CVE-2025-5269Fix available8.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11CVE-2025-5268Fix available8.1 High
- mozilla firefox, thunderbird +1 moreClickjacking vulnerability could have led to leaking saved payment card detailsCVE-2025-5267Fix available5.4 Medium
- mozilla firefox, thunderbird +1 moreScript element events leaked cross-origin resource statusCVE-2025-5266Fix available4.3 Medium
- mozilla firefox, thunderbird +1 morePotential local code execution in “Copy as cURL” commandCVE-2025-5265Fix available4.8 Medium
- mozilla firefox, thunderbird +1 morePotential local code execution in “Copy as cURL” commandCVE-2025-5264Fix available4.8 Medium
- mozilla firefox, thunderbird +1 moreError handling for script execution was incorrectly isolated from web contentCVE-2025-5263Fix available4.3 Medium
- mozilla thunderbirdA double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when...CVE-2025-52627.5 High
- mozilla firefox, firefox for ios +1 moreLinks using non-HTTP schemes opened from other apps such as Safari could have allowed spoofing of website addressesCVE-2025-50204.3 Medium
- mozilla firefox, thunderbird +1 moreOut-of-bounds access when optimizing linear sumsCVE-2025-4919Fix available8.8 High
- mozilla firefox, thunderbird +1 moreOut-of-bounds access when resolving Promise objectsCVE-2025-4918Fix available9.8 Critical
- mozilla thunderbirdTracking Links in Attachments Bypassed Remote Content BlockingCVE-2025-3932Fix available6.5 Medium
- mozilla thunderbirdJavaScript Execution via Spoofed PDF Attachment and file:/// LinkCVE-2025-3909Fix available8.1 High
- mozilla thunderbirdSender Spoofing via Malformed From Header in ThunderbirdCVE-2025-3875Fix available7.5 High
- mozilla firefox focus, focus +1 moreFirefox Focus elide URL allows address bar spoofingCVE-2025-38596.1 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10CVE-2025-4093Fix available8.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 138 and Thunderbird 138CVE-2025-4092Fix available6.5 Medium
- Show moreLoading…