Filtered by vendor Mozilla
Subscribe
Total
3978 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-8029 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 8.1 HIGH |
| Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1. | |||||
| CVE-2025-1940 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 7.1 HIGH |
| A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.*. This vulnerability was fixed in Firefox 136. | |||||
| CVE-2025-4085 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 7.1 HIGH |
| An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. This vulnerability was fixed in Firefox 138 and Thunderbird 138. | |||||
| CVE-2025-6428 | 2 Google, Mozilla | 2 Android, Firefox | 2026-09-30 | N/A | 4.3 MEDIUM |
| When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140. | |||||
| CVE-2025-4086 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 6.5 MEDIUM |
| A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and Thunderbird 138. | |||||
| CVE-2025-6434 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 4.3 MEDIUM |
| The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability was fixed in Firefox 140 and Thunderbird 140. | |||||
| CVE-2025-5271 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 6.5 MEDIUM |
| Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139. | |||||
| CVE-2025-6429 | 1 Mozilla | 1 Firefox | 2026-09-30 | N/A | 6.5 MEDIUM |
| Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypassed website security checks that restricted which domains users were allowed to embed. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12. | |||||
| CVE-2025-3031 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-30 | N/A | 6.5 MEDIUM |
| An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137. | |||||
| CVE-2026-92238 | 1 Mozilla | 1 Thunderbird | 2026-09-24 | N/A | 9.8 CRITICAL |
| A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |||||
| CVE-2026-92239 | 1 Mozilla | 1 Thunderbird | 2026-09-24 | N/A | 8.1 HIGH |
| A maliciously constructed IMAP line could cause an out-of-bounds buffer read. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |||||
| CVE-2026-92240 | 1 Mozilla | 1 Thunderbird | 2026-09-24 | N/A | 9.1 CRITICAL |
| A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser by sending an untagged '* ID' response, crashing Thunderbird. The affected parsing path is reachable before authentication. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | |||||
| CVE-2026-2771 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-21 | N/A | 9.8 CRITICAL |
| Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. | |||||
| CVE-2026-84637 | 1 Mozilla | 1 Thunderbird | 2026-09-03 | N/A | 9.8 CRITICAL |
| Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbird's normal executable attachment protections. With the new invitation display enabled, the attachment could also appear under a misleading filename. This vulnerability was fixed in Thunderbird 154 and Thunderbird 153.2. | |||||
| CVE-2026-84639 | 1 Mozilla | 1 Thunderbird | 2026-09-03 | N/A | 9.1 CRITICAL |
| Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. | |||||
| CVE-2026-84640 | 1 Mozilla | 1 Thunderbird | 2026-09-03 | N/A | 7.5 HIGH |
| A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. | |||||
| CVE-2026-84641 | 1 Mozilla | 1 Thunderbird | 2026-09-03 | N/A | 7.5 HIGH |
| A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. | |||||
| CVE-2026-84642 | 1 Mozilla | 1 Thunderbird | 2026-09-03 | N/A | 7.5 HIGH |
| The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2. | |||||
| CVE-2026-84130 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-03 | N/A | 7.5 HIGH |
| Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | |||||
| CVE-2026-84132 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-09-03 | N/A | 7.5 HIGH |
| Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | |||||