https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:45:22.588612+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2025:4229 ALSA-2025:4229 — Important: thunderbird security update 2026-10-03T19:45:22.981714+00:00

Affected: AlmaLinux:9: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: User Interface (UI) Misrepresentation of attachment URL (CVE-2025-3523) * thunderbird: Information Disclosure of /tmp directory listing (CVE-2025-2830) * thunderbird: Leak of hashed Window credentials via crafted attachment URL (CVE-2025-3522)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

 https://cve.radiocsirt.org/vuln/bdu:2025-06569 bdu:2025-06569 2026-10-03T19:45:22.981790+00:00 bdu:2025-06569 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0317 certfr-2025-avi-0317 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Elles permettent à un attaquant de provoquer… 2026-10-03T19:45:22.981808+00:00 certfr-2025-avi-0317 https://cve.radiocsirt.org/vuln/euvd-2026-290729 EUVD-2026-290729 2026-10-03T19:45:22.981826+00:00 EUVD-2026-290729 https://cve.radiocsirt.org/vuln/fkie_cve-2025-2830 fkie_cve-2025-2830 2026-10-03T19:45:22.981837+00:00

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

 https://cve.radiocsirt.org/vuln/ghsa-g6gh-87cw-x396 GHSA-g6gh-87cw-x396 2026-10-03T19:45:22.981862+00:00

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability affects Thunderbird < 137.0.2 and Thunderbird < 128.9.2.

 https://cve.radiocsirt.org/vuln/oesa-2025-1835 OESA-2025-1835 — thunderbird security update 2026-10-03T19:45:22.981880+00:00

Affected: openEuler:24.03-LTS-SP2: thunderbird

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es):

A permission leak could have occurred from a trusted site to an untrusted site via `embed` or `object` elements. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Firefox ESR &lt; 115.17, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10458)

An attacker could have caused a use-after-free when accessibility was enabled, leading to a potentially exploitable crash. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Firefox ESR &lt; 115.17, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10459)

The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10460)

In multipart/x-mixed-replace responses, `Content-Disposition: attachment` in the response header was not respected and did not force a download, which could allow XSS attacks. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10461)

Truncation of a long URL could have allowed origin spoofing in a permission prompt. This vulnerability affects Firefox &lt; 132, Firefox ESR &lt; 128.4, Thunderbird &lt; 128.4, and Thunderbird &lt; 132.(CVE-2024-10462)

Video frames could have been leaked between origins in some situations. Thi…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15000-1 openSUSE-SU-2025:15000-1 — MozillaThunderbird-128.9.2-1.1 on GA media 2026-10-03T19:45:22.982053+00:00

MozillaThunderbird-128.9.2-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2025:4389 RHSA-2025:4389 — Red Hat Security Advisory: thunderbird security update 2026-10-03T19:45:22.982074+00:00

thunderbird: Information Disclosure of /tmp directory listing thunderbird: Leak of hashed Window credentials via crafted attachment URL thunderbird: User Interface (UI) Misrepresentation of attachment URL

 https://cve.radiocsirt.org/vuln/suse-su-2025:1366-1 SUSE-SU-2025:1366-1 — Security update for MozillaThunderbird 2026-10-03T19:45:22.982093+00:00

Security update for MozillaThunderbird

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-2830 UBUNTU-CVE-2025-2830 2026-10-03T19:45:22.982110+00:00

Affected: Ubuntu:22.04:LTS: thunderbird

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the victim's system. This vulnerability is not limited to Linux; similar behavior has been observed on Windows as well. This vulnerability was fixed in Thunderbird 137.0.2 and Thunderbird 128.9.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0803 WID-SEC-W-2025-0803 — Mozilla Thunderbird und Thunderbird ESR: Mehrere Schwachstellen 2026-10-03T19:45:22.982132+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird ausnutzen, um Informationen preiszugeben und Spoofing-Angriffe durchzuführen.