Open Source Vulnerabilities

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

suspected race condition when calling getaddrinfo led to memory corruption and a potentially exploitable crash

libvterm

libvterm through 0+bzr726, as used in Vim and other products, mishandles certain out-of-memory conditions, leading to a denial of service (application crash), related to screen

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

use-after-free vulnerability in media channels could have led to memory corruption and a potentially exploitable crash

nodejs-23, nodejs-current, nodejs18, nodejs18

Due to the formatting logic of the "console

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Instruction reordering resulted in a sequence of instructions that would cause an object to be incorrectly considered during garbage collection

nodejs-23, nodejs-current, nodejs18, nodejs18

Node

librewolf, librewolf, librewolf, librewolf, librewolf

Firefox for Android could get stuck in fullscreen mode and not exit it even after normal interactions that should cause it to exit

nodejs-23, nodejs-current, nodejs18, nodejs18

Node

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Due to incorrect JIT optimization, we incorrectly interpreted data from the wrong type of object, resulting in the potential leak of a single bit of memory

nodejs-23, nodejs-current, nodejs18, nodejs18

Accepting arbitrary Subject Alternative Name (SAN) types, unless a PKI is specifically defined to use a particular SAN type, can result in bypassing name-constrained intermediates

libsass

Stack overflow vulnerability in ast_selectors

sdl2_image

buffer overflow vulnerability exists in the GIF image parsing functionality of SDL2_image-2

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

issue present in lowering/register allocation could have led to obscure but deterministic register confusion failures in JITted code that would lead to a potentially exploitable crash

libsass

Stack overflow vulnerability in ast_selectors

nodejs-23, nodejs-current, nodejs18, nodejs18

llhttp parser in the http module in Node v18

sdl2_image

double-Free vulnerability exists in the XCF image rendering functionality of SDL2_image-2

nodetaint, py3-asyncssh, py3-paramiko, openssh, libssh, gitea-fips, k3s, podman, nebula, podman-tui, proftpd, forgejo, k3sup, dropbear, tinyssh, putty, libssh2, pijul

SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Uninitialized memory in a canvas object could have caused an incorrect free() leading to memory corruption and a potentially exploitable crash

libsass

Stack Overflow vulnerability in libsass 3

sdl2_image

exploitable code execution vulnerability exists in the XCF image rendering functionality of SDL2_image-2

nodejs-23, nodejs-current, nodejs18, nodejs18

weak randomness in WebCrypto keygen vulnerability exists in Node

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91

sdl2_image

exploitable code execution vulnerability exists in the BMP image rendering functionality of SDL2_image-2

nodejs-23, nodejs-current, nodejs18, nodejs18

llhttp parser <v14

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 92 and Firefox ESR 91

sdl2_image

exploitable code execution vulnerability exists in the ICO image rendering functionality of SDL2_image-2

nodejs-23, nodejs-current, nodejs18, nodejs18

llhttp parser <v14

ruby-activesupport

regular expression based DoS vulnerability in Active Support <6

sdl2_image

exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2

librewolf, librewolf, librewolf, librewolf, librewolf

Mozilla developers reported memory safety bugs present in Firefox 92

ruby-activesupport

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input

sdl2_image

exploitable code execution vulnerability exists in the ILBM image rendering functionality of SDL2_image-2

nodejs-23, nodejs-current, nodejs18, nodejs18

llhttp parser <v14

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

During process shutdown, a document could have caused a use-after-free of a languages service object, leading to memory corruption and a potentially exploitable crash

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Through use of reportValidity() and window

nodejs-23, nodejs18, nodejs18

OS Command Injection vulnerability exists in Node

ruby-addressable

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

During operations on MessageTasks, a task may have been removed while it was still scheduled, resulting in memory corruption and a potentially exploitable crash

nodejs-23, nodejs18, nodejs18

buffer overrun can be triggered in X

openstack-keystone-2026.1

openstack-keystone-2026.1

openstack-keystone-2026.1

openstack-keystone-2026.1

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust

nodejs-23, nodejs18, nodejs18

buffer overrun can be triggered in X

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

executable file warning was not presented when downloading

nodejs-23, nodejs18, nodejs18

Undici is an HTTP/1

xerces-c

Apache Xerces-C 3

thunderbird, librewolf, librewolf, librewolf, librewolf, librewolf

Due to an unusual sequence of attacker-controlled events, a Javascript alert() dialog with arbitrary (although unstyled) contents could be displayed over top an uncontrolled webpage of the attacker...

nodejs-23, nodejs18, nodejs18

Undici is an HTTP/1