smartlist_add, smartlist_insert (may) cause heap corruption as a result of inadequate checks in smartlist_ensure_capacity #112386 Valid Memory Corruption – 2017-10-19 – 6 [tor] libevent dns remote stack overread vulnerability #112632 Valid Memory Corruption – 2017-10-19 – 6 libevent (stack) buffer overflow in evutil_parse_sockaddr_port #112784 Valid Memory Corruption – 2017-10-19 – 6 Overreads/overcopies in torsocks #126598 Valid Memory Corruption – 2017-10-19 – 6 Heap corruption via memarea.c #138025 Valid Memory Corruption – 2017-10-19 – 6 potential memory corruption in or/buffers.c (particularly on 32 bit) #163459 Valid Memory Corruption – 2017-10-19 – 6 [tor] control connection pre-auth DoS (infinite loop) with --enable-bufferevents #113424 Valid Denial of Service – 2017-10-19 – 7 [tor] libevent dns OOB read #115702 Valid Memory Corruption – 2017-10-19 – 7 [tor] pre-emptive defenses, potential vulnerabilities #115686 Valid Misconfiguration and Insecure Design – 2017-11-26 – 8 Simple CSS line-height identifies platform #256647 Valid Information Disclosure – 2017-10-20 – 10 languagechange event fires simultaneously on all tabs #257942 Valid Information Disclosure – 2017-10-19 $100 10 16 instances where return value of OpenSSL i2d_RSAPublicKey is discarded -- might lead to use of uninitialized memory #142773 Valid Information Disclosure – 2017-11-26 – 11 Detect Tor Browser's language #588239 Valid Information Disclosure – 2019-05-29 – 11 Access to local file system using javascript #258630 Valid Misconfiguration and Insecure Design – 2017-11-18 – 15 De-anonymization by visiting specially crafted bookmark. #294364 Valid Information Disclosure – 2018-07-03 – 15 Tor onion service INTRODUCE2 invalid-MAC cells permanently grow service replay cache #3709703 Valid Denial of Service Low 2026-09-10 – 28 Scrollbar Width permits detecting browser platform #252580 Valid Information Disclosure – 2017-10-20 – 29 Snowflake server: Leak of TLS packets from other clients #1880610 Valid Information Disclosure – 2023-03-15 – 30 Conflux-queued zero-length RELAY_END triggers heap out-of-bounds read #3709605 Valid Memory Corruption Medium 2026-09-10 – 33 Malicious Conflux Endpoint Can Leave Stale Global OOO Queue Accounting After Teardown #3701692 Valid Denial of Service Low 2026-06-16 $100 35 XSS on about:tbupdate #253076 Valid Cross-site Scripting – 2023-11-28 $100 43 Detecting Tor Browser UI Language #282748 Valid Information Disclosure – 2019-05-21 – 64 Linux TBB SFTP URI allows local IP disclosure #253429 Valid Information Disclosure – 2017-10-25 $3,000 71