← Back

Mozilla

mozilla

3,934 CVEs • 44 products

Products (44)

Click to collapse
Toggle
Firefox
firefox
3,473 CVEs
Thunderbird
thunderbird
2,068 CVEs
Seamonkey
seamonkey
704 CVEs
Firefox Esr
firefox_esr
487 CVEs
Thunderbird Esr
thunderbird_esr
228 CVEs
Bugzilla
bugzilla
145 CVEs
Mozilla
mozilla
108 CVEs
Firefox Mobile
firefox_mobile
87 CVEs
Network Security Services
network_security_services
50 CVEs
Mozilla Suite
mozilla_suite
27 CVEs
Firefox Focus
firefox_focus
20 CVEs
Focus
focus
16 CVEs
Firefox Os
firefox_os
14 CVEs
Nss
nss
6 CVEs
Bleach
bleach
5 CVEs
Bonsai
bonsai
4 CVEs
Camino
camino
4 CVEs
Vpn
vpn
4 CVEs
Netscape Portable Runtime
netscape_portable_runtime
3 CVEs
Convict
convict
3 CVEs
Nunjucks
nunjucks
2 CVEs
Mozjpeg
mozjpeg
2 CVEs
Webthings Gateway
webthings_gateway
2 CVEs
Pollbot
pollbot
2 CVEs
Geckodriver
geckodriver
2 CVEs
Gecko
gecko
1 CVE
Durian Web Application Server
durian_web_application_server
1 CVE
Geckb
geckb
1 CVE
Libxul
libxul
1 CVE
Zamboni
zamboni
1 CVE
Firefoxos
firefoxos
1 CVE
Persona
persona
1 CVE
Hubs Cloud Reticulum
hubs_cloud_reticulum
1 CVE
Hubs Cloud
hubs_cloud
1 CVE
Mozilla Vpn
mozilla_vpn
1 CVE
Nss Esr
nss_esr
1 CVE
Hawk
hawk
1 CVE
Common Voice
common_voice
1 CVE
Sccache
sccache
1 CVE
Neqo
neqo
1 CVE
Rhino
rhino
1 CVE
0din Scanner
0din_scanner
1 CVE
Thin Vec
thin-vec
1 CVE
Klar
klar
1 CVE

CVEs (3,934)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-4776
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
8.2 HIGH· v3
N/A· v2
A file dialog shown while in full-screen mode could have resulted in the window remaining disabled. This vulnerability affects Firefox < 126.
CVE-2024-4775
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
5.9 MEDIUM· v3
N/A· v2
An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profi...Show more
An iterator stop condition was missing when handling WASM code in the built-in profiler, potentially leading to invalid memory access and undefined behavior. *Note:* This issue only affects the application when the profiler is running. This vulnerability affects Firefox < 126.Show less
CVE-2024-4774
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
The `ShmemCharMapHashEntry()` code was susceptible to potentially undefined behavior by bypassing the move semantics for one of its data members. This vulnerability affects Firefox < 126.
CVE-2024-4773
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
When a network error occurred during page load, the prior content could have remained in view with a blank URL bar. This could have been used to obfuscate a spoofed web site. This vulnerability affects Firefox < 126.
CVE-2024-4772
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
5.9 MEDIUM· v3
N/A· v2
An HTTP digest authentication nonce value was generated using `rand()` which could lead to predictable values. This vulnerability affects Firefox < 126.
CVE-2024-4771
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
8.6 HIGH· v3
N/A· v2
A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Fir...Show more
A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox < 126.Show less
CVE-2024-4770
1Mozilla
2Firefox
Thunderbird
Jun 17, 2026
May 14, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
When saving a page to PDF, certain font styles could have led to a potential use-after-free crash. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVE-2024-4769
2Debian
Mozilla
3Debian Linux
FirefoxThunderbird
Jun 17, 2026
May 14, 2024
N/A· v4
5.9 MEDIUM· v3
N/A· v2
When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-ori...Show more
When importing resources using Web Workers, error messages would distinguish the difference between `application/javascript` responses and non-script responses. This could have been abused to learn information cross-origin. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.Show less
CVE-2024-4768
2Debian
Mozilla
3Debian Linux
FirefoxThunderbird
Jun 17, 2026
May 14, 2024
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A bug in popup notifications' interaction with WebAuthn made it easier for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVE-2024-4767
2Debian
Mozilla
3Debian Linux
FirefoxThunderbird
Jun 17, 2026
May 14, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability affects Firefo...Show more
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.Show less
CVE-2024-4766
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox for Android. Other versio...Show more
Different techniques existed to obscure the fullscreen notification in Firefox for Android. These could have led to potential user confusion and spoofing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.Show less
CVE-2024-4765
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another applicat...Show more
Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. *This issue only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 126.Show less
CVE-2024-4764
1Mozilla
1Firefox
Jun 17, 2026
May 14, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Multiple WebRTC threads could have claimed a newly connected audio input leading to use-after-free. This vulnerability affects Firefox < 126.
CVE-2024-4367
3Debian
MozillaOpen Xchange
4Debian Linux
FirefoxOpen Xchange Appsuite Frontend+1 more
Jun 17, 2026
May 14, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.
CVE-2024-3865
1Mozilla
1Firefox
Jun 17, 2026
Apr 16, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability...Show more
Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 125.Show less
CVE-2024-3864
2Debian
Mozilla
3Debian Linux
FirefoxThunderbird
Jun 17, 2026
Apr 16, 2024
N/A· v4
8.1 HIGH· v3
N/A· v2
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary cod...Show more
Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.Show less
CVE-2024-3863
1Mozilla
2Firefox
Thunderbird
Jun 17, 2026
Apr 16, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 125...Show more
The executable file warning was not presented when downloading .xrm-ms files. *Note: This issue only affected Windows operating systems. Other operating systems are unaffected.* This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.Show less
CVE-2024-3862
1Mozilla
1Firefox
Jun 17, 2026
Apr 16, 2024
N/A· v4
5.3 MEDIUM· v3
N/A· v2
The MarkStack assignment operator, part of the JavaScript engine, could access uninitialized memory if it were used in a self-assignment. This vulnerability affects Firefox < 125.
CVE-2024-3861
2Debian
Mozilla
3Debian Linux
FirefoxThunderbird
Jun 17, 2026
Apr 16, 2024
N/A· v4
4.0 MEDIUM· v3
N/A· v2
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird...Show more
If an AlignedBuffer were assigned to itself, the subsequent self-move could result in an incorrect reference count and later use-after-free. This vulnerability affects Firefox < 125, Firefox ESR < 115.10, and Thunderbird < 115.10.Show less
CVE-2024-3860
1Mozilla
1Firefox
Jun 17, 2026
Apr 16, 2024
N/A· v4
6.2 MEDIUM· v3
N/A· v2
An out-of-memory condition during object initialization could result in an empty shape list. If the JIT subsequently traced the object it would crash. This vulnerability affects Firefox < 125.