Filtered by vendor Mozilla
Subscribe
Total
3978 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100822 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 5.4 MEDIUM |
| Spoofing issue in the Networking: HTTP component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100824 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 8.8 HIGH |
| Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100825 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 8.8 HIGH |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100826 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 6.5 MEDIUM |
| Denial-of-service in the Storage: StorageManager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100828 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 9.6 CRITICAL |
| Mitigation bypass in the Bookmarks & History component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100829 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 9.6 CRITICAL |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100830 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 8.1 HIGH |
| Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2026-100831 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-13 | N/A | 8.8 HIGH |
| Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | |||||
| CVE-2011-3389 | 9 Canonical, Debian, Google and 6 more | 17 Ubuntu Linux, Debian Linux, Chrome and 14 more | 2026-10-09 | 4.3 MEDIUM | N/A |
| The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. | |||||
| CVE-2016-9063 | 3 Debian, Mozilla, Python | 3 Debian Linux, Firefox, Python | 2026-10-08 | 7.5 HIGH | 9.8 CRITICAL |
| An integer overflow during the parsing of XML using the Expat library. This vulnerability affects Firefox < 50. | |||||
| CVE-2016-0718 | 9 Apple, Canonical, Debian and 6 more | 14 Mac Os X, Ubuntu Linux, Debian Linux and 11 more | 2026-10-08 | 7.5 HIGH | 9.8 CRITICAL |
| Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow. | |||||
| CVE-2024-9398 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-08 | N/A | 5.3 MEDIUM |
| By checking the result of calls to `window.open` with specifically set protocol handlers, an attacker could determine if the application which implements that protocol handler is installed. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131. | |||||
| CVE-2025-11718 | 2 Google, Mozilla | 2 Android, Firefox | 2026-10-08 | N/A | 6.5 MEDIUM |
| When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event. This vulnerability was fixed in Firefox 144. | |||||
| CVE-2025-11720 | 2 Google, Mozilla | 2 Android, Firefox | 2026-10-08 | N/A | 8.1 HIGH |
| The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144. | |||||
| CVE-2025-11717 | 2 Google, Mozilla | 2 Android, Firefox | 2026-10-08 | N/A | 9.1 CRITICAL |
| When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability was fixed in Firefox 144. | |||||
| CVE-2025-12380 | 1 Mozilla | 1 Firefox | 2026-10-08 | N/A | 9.8 CRITICAL |
| Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2. | |||||
| CVE-2025-14325 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-07 | N/A | 7.3 HIGH |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. | |||||
| CVE-2025-14330 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-07 | N/A | 9.8 CRITICAL |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. | |||||
| CVE-2025-14324 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-07 | N/A | 9.8 CRITICAL |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. | |||||
| CVE-2025-14331 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-07 | N/A | 6.5 MEDIUM |
| Same-origin policy bypass in the Request Handling component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. | |||||