Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3516 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-6426 2 Apple, Mozilla 3 Macos, Firefox, Firefox Esr 2026-04-20 8.8 High
The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.
CVE-2025-8036 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-04-20 8.1 High
Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1.
CVE-2025-8034 2 Mozilla, Redhat 4 Firefox, Firefox Esr, Thunderbird and 1 more 2026-04-20 8.8 High
Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 115.26, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.
CVE-2025-11153 1 Mozilla 1 Firefox 2026-04-20 7.5 High
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.
CVE-2025-10859 2 Apple, Mozilla 3 Ios, Firefox, Firefox For Ios 2026-04-20 4 Medium
Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing information from private tabs to escape Incognito mode even after the user closed all tabs. This vulnerability was fixed in Firefox for iOS 143.1.
CVE-2025-11720 2 Google, Mozilla 2 Android, Firefox 2026-04-20 8.1 High
The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.
CVE-2025-13012 1 Mozilla 2 Firefox, Firefox Esr 2026-04-20 7.5 High
Race condition in the Graphics component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Firefox ESR 115.30, Thunderbird 145, and Thunderbird 140.5.
CVE-2025-13017 1 Mozilla 2 Firefox, Firefox Esr 2026-04-20 8.1 High
Same-origin policy bypass in the DOM: Notifications component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
CVE-2025-13019 1 Mozilla 2 Firefox, Firefox Esr 2026-04-20 8.1 High
Same-origin policy bypass in the DOM: Workers component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
CVE-2025-13020 1 Mozilla 2 Firefox, Firefox Esr 2026-04-20 8.8 High
Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5.
CVE-2025-14321 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-04-20 9.8 Critical
Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14325 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-04-20 7.3 High
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14327 1 Mozilla 2 Firefox, Thunderbird 2026-04-20 7.5 High
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
CVE-2025-14328 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-04-20 8.8 High
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-14330 1 Mozilla 3 Firefox, Firefox Esr, Thunderbird 2026-04-20 9.8 Critical
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.
CVE-2025-27425 2 Apple, Mozilla 2 Iphone Os, Firefox 2026-04-20 4.3 Medium
Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. This vulnerability was fixed in Firefox for iOS 136.
CVE-2025-3033 1 Mozilla 2 Firefox, Thunderbird 2026-04-20 7.7 High
After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 137 and Thunderbird 137.
CVE-2025-3034 1 Mozilla 2 Firefox, Thunderbird 2026-04-20 8.1 High
Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137 and Thunderbird 137.
CVE-2025-3035 1 Mozilla 1 Firefox 2026-04-20 5.3 Medium
By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This vulnerability was fixed in Firefox 137.
CVE-2025-3608 1 Mozilla 1 Firefox 2026-04-20 6.5 Medium
A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This vulnerability was fixed in Firefox 137.0.2.