https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T18:41:03.892950+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:2359 ALSA-2025:2359 — Important: firefox security update 2026-10-04T18:41:03.941587+00:00

Affected: AlmaLinux:9: firefox, AlmaLinux:9: firefox-x11

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Use-after-free in WebTransportChild (CVE-2025-1931) * firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process (CVE-2025-1930) * firefox: Unexpected GC during RegExp bailout processing (CVE-2025-1934) * firefox: Clickjacking the registerProtocolHandler info-bar Reporter (CVE-2025-1935) * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1938) * firefox: JIT corruption of WASM i32 return values on 64-bit CPUs (CVE-2025-1933) * firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 (CVE-2025-1937) * firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access (CVE-2025-1932) * firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents (CVE-2025-1936)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-02599 bdu:2025-02599 2026-10-04T18:41:03.941667+00:00 bdu:2025-02599 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0176 certfr-2025-avi-0176 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta… 2026-10-04T18:41:03.941687+00:00 certfr-2025-avi-0176 https://cve.radiocsirt.org/vuln/euvd-2026-324631 EUVD-2026-324631 2026-10-04T18:41:03.941703+00:00 EUVD-2026-324631 https://cve.radiocsirt.org/vuln/fkie_cve-2025-1930 fkie_cve-2025-1930 2026-10-04T18:41:03.941714+00:00

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

 https://cve.radiocsirt.org/vuln/ghsa-5289-2q6r-6q3g GHSA-5289-2q6r-6q3g 2026-10-04T18:41:03.941736+00:00

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability affects Firefox < 136, Firefox ESR < 115.21, and Firefox ESR < 128.8.

 https://cve.radiocsirt.org/vuln/oesa-2025-1835 OESA-2025-1835 — thunderbird security update 2026-10-04T18:41:03.941753+00:00

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Firefox ESR &lt; 115.17, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Firefox ESR &lt; 115.17, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. Thi…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14852-1 openSUSE-SU-2025:14852-1 — firefox-esr-128.8.0-1.1 on GA media 2026-10-04T18:41:03.941920+00:00

firefox-esr-128.8.0-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:2479 RHSA-2025:2479 — Red Hat Security Advisory: firefox security update 2026-10-04T18:41:03.941944+00:00

firefox: AudioIPC StreamData could trigger a use-after-free in the Browser process firefox: Use-after-free in WebTransportChild firefox: Inconsistent comparator in XSLT sorting led to out-of-bounds access firefox: JIT corruption of WASM i32 return values on 64-bit CPUs firefox: Unexpected GC during RegExp bailout processing firefox: Clickjacking the registerProtocolHandler info-bar Reporter firefox: Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8 firefox: thunderbird: Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8

 https://cve.radiocsirt.org/vuln/suse-su-2025:0783-1 SUSE-SU-2025:0783-1 — Security update for MozillaFirefox 2026-10-04T18:41:03.941977+00:00

Security update for MozillaFirefox

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-1930 UBUNTU-CVE-2025-1930 2026-10-04T18:41:03.941996+00:00

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led to a sandbox escape. This vulnerability was fixed in Firefox 136, Firefox ESR 115.21, Firefox ESR 128.8, Thunderbird 136, and Thunderbird 128.8.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0482 WID-SEC-W-2025-0482 — Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird: Mehrere Schwachstellen 2026-10-04T18:41:03.942030+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um Spoofing-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, erhöhte Privilegien zu erlangen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Daten zu manipulieren, beliebigen Code auszuführen oder nicht spezifizierte Auswirkungen zu verursachen.