Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8JIT miscompilation, use-after-free in the JavaScript Engine: JIT component.EPSS 0.6%Feb 24, 2026
- Critical9.8Use-after-free in the JavaScript Engine component.EPSS 0.6%Feb 24, 2026
- Critical9.8Integer overflow in the JavaScript: Standard Library component.EPSS 0.7%Feb 24, 2026
- Critical10.0Sandbox escape in the Graphics: WebRender component.EPSS 0.6%Feb 24, 2026
- Critical10.0Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component.EPSS 0.6%Feb 24, 2026
- Critical9.8Incorrect boundary conditions in the Graphics: ImageLib component.EPSS 0.6%Feb 24, 2026
- Critical9.8Use-after-free in the JavaScript: GC component.EPSS 0.6%Feb 24, 2026
- Critical9.8Incorrect boundary conditions in the WebRTC: Audio/Video component.EPSS 0.6%Feb 24, 2026
- Critical9.8Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled page…EPSS 0.5%Feb 24, 2026
- UnknownFirefox Incorrect Handle Sandbox EscapeKEVEPSS 1.9%Jan 20, 2026
- Critical9.4Ray-Project Ray Code Injection VulnerabilityKEVEPSS 62.5%Nov 26, 2025
- Medium6.5A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saviEPSS 0.6%Jun 11, 2025
- Critical9.8An integer overflow was present in used by the JavaScript engine.EPSS 0.7%Jun 11, 2025
- High7.8A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root.EPSS 0.1%Jun 11, 2025
- Critical9.8Certain canvas operations could have lead to memory corruption.EPSS 0.7%Jun 11, 2025
- High7.3Memory safety bugs present in Firefox 138 and Thunderbird 138.EPSS 0.3%May 27, 2025
- Medium6.5Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks.EPSS 0.3%May 27, 2025
- High7.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.EPSS 0.3%May 27, 2025
- High8.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10.EPSS 0.5%May 27, 2025
- High8.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.EPSS 0.5%May 27, 2025
- Medium5.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page.EPSS 0.3%May 27, 2025
- Medium4.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks.EPSS 0.3%May 27, 2025
- Medium4.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code exeEPSS 0.2%May 27, 2025
- Medium4.8Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execuEPSS 0.3%May 27, 2025
- Medium4.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks.EPSS 0.2%May 27, 2025