Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled.Check if you run itEPSS 0.29%May 27, 2025
- High8.1Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10.Check if you run itEPSS 0.46%May 27, 2025
- High8.1Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10.Check if you run itEPSS 0.49%May 27, 2025
- Medium5.4A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page.Check if you run itEPSS 0.27%May 27, 2025
- Medium4.3Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks.Check if you run itEPSS 0.33%May 27, 2025
- Medium4.8Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code exeCheck if you run itEPSS 0.21%May 27, 2025
- Medium4.8Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leading to local code execuCheck if you run itEPSS 0.29%May 27, 2025
- Medium4.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks.Check if you run itEPSS 0.25%May 27, 2025
- High7.5A double-free could have occurred in after a failed allocation when initializing the encoder for WebRTC.Check if you run itEPSS 0.45%May 27, 2025
- High8.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes.Check if you run itEPSS 8.67%May 17, 2025
- Critical9.8An attacker was able to perform an out-of-bounds read or write on a JavaScript object.Check if you run itEPSS 9.43%May 17, 2025
- Medium6.5It was possible to craft an email that showed a tracking link as an attachment.Check if you run itEPSS 0.39%May 14, 2025
- High8.1Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context.Check if you run itEPSS 0.47%May 14, 2025
- High7.5Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used.Check if you run itEPSS 0.40%May 14, 2025
- High8.1Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9.Check if you run itEPSS 0.48%Apr 29, 2025
- Medium6.5Memory safety bugs present in Firefox 137 and Thunderbird 137.Check if you run itEPSS 0.30%Apr 29, 2025
- High8.1Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9.Check if you run itEPSS 0.50%Apr 29, 2025
- Medium5.3A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat.Check if you run itEPSS 0.33%Apr 29, 2025
- Medium5.1Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code executioCheck if you run itEPSS 0.19%Apr 29, 2025
- Medium6.5A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invoked the Storage AccesCheck if you run itEPSS 0.18%Apr 29, 2025
- Medium4.8A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access.Check if you run itEPSS 0.32%Apr 29, 2025
- Medium6.5A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog.Check if you run itEPSS 0.29%Apr 29, 2025
- High7.1An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges.Check if you run itEPSS 0.30%Apr 29, 2025
- Medium5.7Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading to local code execCheck if you run itEPSS 0.44%Apr 29, 2025
- Critical9.1A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's process insteaCheck if you run itEPSS 0.45%Apr 29, 2025