firefox-devtools-mcp

Firefox DevTools MCP Model Context Protocol server for automating Firefox via WebDriver BiDi through Selenium WebDriver. Works with Claude Code, Claude Desktop, Cursor, Cline and other MCP clients. Repository: https://github.com/mozilla/firefox-devtools-mcp Note : This MCP server requires a local...

bidi-guard

bidi-guard Escanea código en busca de caracteres Unicode bidireccionales invisibles Por Qué Existe Esto Los caracteres Unicode bidireccionales invisibles pueden hacer que el código fuente se muestre de forma distinta a como se ejecuta. Esto es CVE-2021-42574 — el ataque Trojan Source. Un atacante...

CVE-2021-42574

CVE-2021-42574 - Code generator // Update: 05.11.2021 It's now possible to not only encode, but also decode files. Means that now files containing supported bidi chars can be translated to template files with bidi placeholders LRO, .... Generate malicious files using recently published bidi-attac...

bidi_char_detector

BIDI Character Detector This tool checks your files for existence of Unicode BIDI characters which can be misused for supply chain attacks to mitigate CVE-2021-42574. This tool was written in Rust and is distributed as a small 3MB docker compatible container to allow fast and easy usage. For an...

CVE-2026-84128

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

CVE-2026-84128 Privilege escalation in the WebDriver BiDi component

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

CVE-2026-84128

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

CVE-2026-84128 Privilege escalation in the WebDriver BiDi component

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

CVE-2026-84128

CVE-2026-84128 is a privilege escalation vulnerability in the WebDriver BiDi component of Firefox , fixed in Firefox 155 . The bug is tracked in Mozilla Bugzilla #2044280 and disclosed via MFSA2026-82 . The CVSS 3.1 score is 8.8 (HIGH) with a network attack vector, low complexity, no privileges r...

EUVD-2026-69077

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155...

PT-2026-84181

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 155 Thunderbird versions prior to 155 Description Privilege escalation exists in the WebDriver BiDi component. WebDriver BiDi is a protocol that allows for bidirectional communication between the browser and the...

CVE-2026-81685

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

EUVD-2026-67041

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

CVE-2026-81685

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters, injecting forged text into the irreversible-removal confirmation dialog and...

CVE-2026-81685 openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata

opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bi...

Astra Linux – Vulnerability in Fribidi

A segmentation fault flaw was discovered in the Fribidi package, affecting the fribidiremovebidimarks function in the lib/fribidi.c file. This flaw allows an attacker to submit a specially crafted file to Fribidi, resulting in a crash and causing a denial of service...

CVE-2026-48760

Symfony HtmlSanitizer/UrlSanitizer::parse() had an underinclusive denial for BiDi formatting characters and Unicode whitespace, allowing percent-encoded BiDi marks to bypass the check. The issue affects UrlSanitizer::parse() behavior from Symfony 6.1.0 up to 6.4.41, 7.4.13, and 8.0.13, where raw ...

CVE-2026-48760

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...

CVE-2026-48760 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs...