Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 546

Export CSV
CVE-2026-35371

uutils coreutils id Misleading Identity Reporting in Pretty Print Mode

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Uutils
Products
Coreutils
CVE-2026-3861

Repeated OS Dialog Trigger Causing Temporary iOS Device Inoperability via LINE In‑App Browser

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily inoperable.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Line Corporation Linecorp
Products
Line Client For Ios Line
CVE-2025-30467

Malicious Website Causes Address Bar Spoofing on Apple Browsers and Devices

The issue was addressed with improved checks. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. Visiting a malicious website may lead to address bar spoofing.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Ipados Iphone Os Macos and 1 more
CVE-2025-31266

Spoofing of Domain Name in Safari Pop-Up Window Title

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name. This issue is fixed in Safari 18.5, macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos Safari
CVE-2026-33119

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Edge
CVE-2007-6591

konqueror: Certificate accepted for alt names, when only common name is shown

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Kde
Products
Konqueror
CVE-2025-46287

FaceTime Caller ID Spoofing Vulnerability in Apple Platforms

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2. An attacker may be able to spoof their FaceTime caller ID.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apple
Products
Macos Macos Sequoia Macos Sonoma
CVE-2025-8043

Incorrect URL truncation

Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Firefox 141.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2025-1018

Fullscreen notification is not displayed when fullscreen is re-requested

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2025-26696

Crafted email message incorrectly shown as being encrypted

Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown as being encrypted. This vulnerability was fixed in Thunderbird 136 and Thunderbird 128.8.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Thunderbird
CVE-2025-4086

Specially crafted filename could be used to obscure download type

A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. *This bug only affects Thunderbird for Android. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138 and Thunderbird 138.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2025-0510

Address of e-mail sender can be spoofed by malicious email

Thunderbird displayed an incorrect sender address if the From field of an email used the invalid group name syntax that is described in CVE-2024-49040. This vulnerability was fixed in Thunderbird 128.7 and Thunderbird 135.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla Redhat
Products
Thunderbird Enterprise Linux Rhel Aus and 3 more
CVE-2025-11720

Spoofing risk in Android custom tabs

The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability was fixed in Firefox 144.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Google Mozilla
Products
Android Firefox
CVE-2025-14744

Filename spoofing via Unicode Right-to-Left Override in Firefox for iOS

Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files of an unexpected file type. This vulnerability was fixed in Firefox for iOS 144.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Mozilla
Products
Ios Firefox Firefox For Ios
CVE-2025-0244

Address bar spoofing using an invalid protocol scheme on Firefox for Android

When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 134.

CVSS 3.1 · 5.3 Medium EPSS 7.5% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2025-0246

Address bar spoofing using an invalid protocol scheme on Firefox for Android

When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.* *Note: This issue is a different issue from CVE-2025-0244. This vulnerability was fixed in Firefox 134.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Mozilla
Products
Android Firefox
CVE-2025-1019

Fullscreen notification not properly displayed

The z-order of the browser windows could be manipulated to hide the fullscreen notification. This could potentially be leveraged to perform a spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox Thunderbird
CVE-2025-1940

Android Intent confirmation prompt tapjacking using Select options

A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an external app unexpectedly. *This issue only affects Android versions of Firefox.*. This vulnerability was fixed in Firefox 136.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Firefox
CVE-2025-8041

Incorrect URL truncation in Firefox for Android

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Mozilla
Products
Android Firefox