Ecosystem
Alpine
10,696 known vulnerabilities.
Most affected packages
qt6-qtwebengine 553
firefox-esr 491
firefox 358
librewolf 358
qt5-qtwebengine 338
xen 332
chromium 305
thunderbird 227
imagemagick 223
webkit2gtk 207
wireshark 205
curl 196
go 191
openjdk11 183
mariadb 171
openjdk8 170
vim 167
apache2 151
nodejs 149
openjdk17 145
openssl 143
ffmpeg 132
bind 114
dotnet8-runtime 112
py3-django 106
tiff 100
dotnet9-runtime 100
freerdp 100
postgresql15 98
openjdk21 97
wolfssl 97
dotnet10-runtime 93
samba 92
xorg-server 87
imagemagick6 85
qemu 85
graphicsmagick 82
php7 81
ghostscript 80
openjdk7 79
10,657 results · Feed
-
High 8.8
Web-accessible extension pages (pages with a moz-extension:// scheme) were not correctly enforcing the frame-ancestors …
-
High 7.0
If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched …
-
Medium 6.5
Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to conne…
-
Medium 6.5
After accepting an untrusted certificate, handling an empty pkcs7 sequence as part of the certificate data could have l…
-
High 8.8
Mozilla developers Paul Adenot and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96 and Firef…
-
High 7.5
When resizing a popup while requesting fullscreen access, the popup would have become unable to leave fullscreen mode. …
-
High 8.8
Mozilla developers Christian Holler and Jason Kratzer reported memory safety bugs present in Firefox 95. Some of these …
-
Medium 6.5
If a user installed an extension of a particular type, the extension could have auto-updated itself and while doing so,…
-
High 8.8
By using XSL Transforms, a malicious webserver could have served a user an XSL document that would continue to execute …
-
Critical 9.6
If a document created a sandboxed iframe without <code>allow-scripts</code>, and subsequently appended an element to th…
-
Medium 6.5
Malicious websites could have tricked users into accepting launching a program to handle an external URL protocol. This…
-
Medium 6.5
Securitypolicyviolation events could have leaked cross-origin information for frame-ancestors violations. This vulnerab…
-
High 7.1
A Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write …
-
Medium 6.5
By generally accepting and passing resource handles across processes, a compromised content process might have confused…
-
High 8.8
Applying a CSS filter effect could have accessed out of bounds memory. This could have lead to a heap-buffer-overflow c…
-
High 8.8
If a user was convinced to drag and drop an image to their desktop or other folder, the resulting object could have bee…
-
Medium 6.5
When importing resources using Web Workers, error messages would distinguish the difference between <code>application/j…
-
Medium 6.5
Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handli…
-
Medium 4.3
When navigating from inside an iframe while requesting fullscreen access, an attacker-controlled tab could have made th…
-
Medium 6.5
When inserting text while in edit mode, some characters might have lead to out-of-bounds memory access causing a potent…
-
High 8.8
Certain network request objects were freed too early when releasing a network request handle. This could have lead to a…
-
Medium 4.3
Under certain circumstances, a JavaScript alert (or prompt) could have been shown while another website was displayed u…
-
Medium 4.3
When scanning QR codes, Firefox for Android would have allowed navigation to some URLs that do not point to web content…
-
Medium 5.9
A race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window …
-
High 7.5
Constructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could h…
-
High 8.8
When clicking on a tel: link, USSD codes, specified after a <code>\*</code> character, would be included in the phone n…
-
High 8.8
Mozilla developers Calixte Denizet, Kershaw Chang, Christian Holler, Jason Kratzer, Gabriele Svelto, Tyson Smith, Simon…
-
High 8.8
The constructed curl command from the "Copy as curl" feature in DevTools was not properly escaped for PowerShell. This …
-
Critical 9.6
If an attacker could control the contents of an iframe sandboxed with <code>allow-popups</code> but not <code>allow-scr…
-
Medium 4.3
While the text displayed in Autofill tooltips cannot be directly read by JavaScript, the text was rendered using page f…
-
High 8.8
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…
KEV Mar 7, 2022 -
Medium 4.3
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. This…
-
High 8.8
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially explo…
-
Medium 6.5
In unusual circumstances, an individual thread may outlive the thread's manager during shutdown. This could have led to…
-
High 7.5
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming …
-
Medium 6.5
Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>…
-
Critical 9.6CVE-2022-26486 Exploited
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We hav…
KEV Mar 7, 2022 -
Critical 9.8
It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability af…
-
Medium 6.5
When receiving an OpenPGP/MIME signed email message that contains an additional outer MIME message layer, for example a…
-
Critical 9.8
Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, …