Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5A double-free could have occurred in after a failed allocation when initializing the encoder for WebRTC.Check if you run itEPSS 0.45%May 27, 2025
- Medium4.3Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internCheck if you run itEPSS 0.24%May 21, 2025
- High8.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.Check if you run itEPSS 8.67%May 17, 2025
- Critical9.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object.Check if you run itEPSS 9.43%May 17, 2025
- Medium6.5It was possible to craft an email that showed a tracking link as an attachment.Check if you run itEPSS 0.39%May 14, 2025
- High8.1Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context.Check if you run itEPSS 0.47%May 14, 2025
- High7.5Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used.Check if you run itEPSS 0.40%May 14, 2025
- Medium4.3Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were onCheck if you run itEPSS 0.20%Apr 30, 2025
- High8.1Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9.Check if you run itEPSS 0.48%Apr 29, 2025
- Medium6.5Memory safety bugs present in Firefox 137 and Thunderbird 137.Check if you run itEPSS 0.30%Apr 29, 2025
- High8.1Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9.Check if you run itEPSS 0.50%Apr 29, 2025
- Medium5.3A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat.Check if you run itEPSS 0.33%Apr 29, 2025
- Medium5.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code executioCheck if you run itEPSS 0.19%Apr 29, 2025
- Medium6.5A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage AccesCheck if you run itEPSS 0.18%Apr 29, 2025
- Medium4.8A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access.Check if you run itEPSS 0.32%Apr 29, 2025
- Medium6.5A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog.Check if you run itEPSS 0.29%Apr 29, 2025
- High7.1An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges.Check if you run itEPSS 0.30%Apr 29, 2025
- Medium5.7Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execCheck if you run itEPSS 0.44%Apr 29, 2025
- Critical9.1A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process insteaCheck if you run itEPSS 0.45%Apr 29, 2025
- Medium5.9Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges.Check if you run itEPSS 0.45%Apr 29, 2025
- High8.8Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior.Check if you run itEPSS 0.66%Apr 29, 2025
- Medium6.4When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment.Check if you run itEPSS 0.32%Apr 15, 2025
- Medium6.3Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally.Check if you run itEPSS 0.27%Apr 15, 2025
- Medium6.3By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwardCheck if you run itEPSS 0.36%Apr 15, 2025
- Medium6.5A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition.Check if you run itEPSS 0.32%Apr 15, 2025