CVE Vulnerability Catalog

Use-after-free vulnerability in the JavaScript Engine component of Firefox and Thunderbird. It may lead to access to freed memory during JavaScript execution. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. It may lead to access to freed memory during DOM manipulation. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Sandbox escape vulnerability in the DOM: Networking component of Firefox and Thunderbird. It may allow bypassing process isolation mechanisms. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Use-after-free vulnerability in the Layout component of Firefox and Thunderbird. It may lead to access to freed memory during page layout processing. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Privilege escalation due to use-after-free in the Graphics: Canvas2D component of Firefox and Thunderbird. It may lead to access to freed memory during Canvas2D operations. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Use-after-free vulnerability in the JavaScript: GC component of Firefox and Thunderbird. It can lead to undefined memory behavior, including potential code execution. The issue was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Sandbox escape vulnerability in the Form Manager component of Firefox and Thunderbird. It may allow bypassing process isolation and gaining higher privileges. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Information disclosure vulnerability due to uninitialized memory in the Audio/Video component of Firefox and Thunderbird. It may lead to leakage of data from process memory. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Privilege escalation vulnerability due to incorrect boundary conditions in the Networking component of Firefox and Thunderbird. It may allow gaining higher privileges within the process. Fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Sandbox escape vulnerability in the DOM: Navigation component of Firefox and Thunderbird. It may allow bypassing process isolation and gaining higher privileges. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Same-origin policy bypass vulnerability in the DOM: Navigation component of Firefox and Thunderbird. It may allow access to data from other origins contrary to the security policy. Fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting non-atomic budget checks and millisatoshi truncation.

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's __init__.py module when the plugin is marked enabled in the config file without verifying its plugin-password signature. A rogue local process with write access to the Electrum data directory can place plugin code in the plugins/ folder and mark it enabled, causing arbitrary code execution inside the Electrum process.

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an attacker address, tricking users into RBF fee-bumping and signing it.

hagent through commit 761eec6 contains an OS command injection vulnerability. MCP clients can execute shell commands by injecting metacharacters into the args parameter of the hagent_arduino and hagent_esp32 tools, which are interpolated into arduino-cli and idf.py commands run via subprocess.run(shell=True).

nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script.

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py. MCP clients can run commands via unsanitized scanner parameters such as target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True.

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability. Attackers can run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools, embedding $(), backticks or a closing double quote in an existing file or directory name.

esp-mcp through commit 28afddf contains an OS command injection vulnerability. Attackers can run arbitrary commands by supplying shell metacharacters in MCP tool parameters such as target, port, project_path, or project_name passed to asyncio.create_subprocess_shell.

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters.