Read the docs

DuckDuckGo

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

DuckDuckGo records in CISA KEV

No DuckDuckGo vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Duckduckgo 3 records MEDIUM

Records

4 records

TI-2018-04998 CVE-2018-6849 · GHSA-637h-2rp3-w54w

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to…

Priority MEDIUM 43

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request…

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.28713 Published 2018-04-01 No fix listed CWE-200
TI-2020-12206 CVE-2020-15502 · GHSA-p7wp-4j7f-22g3

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS…

Priority LOW 36

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data av…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01533 Published 2020-07-02 No fix listed CWE-200
TI-2025-30744 CVE-2025-48464 · GHSA-4v24-3w3q-g36w

Exposure of sensitive information in DuckDuckGo Browser

Priority LOW 21

Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00139 Published 2025-10-08 No fix listed CWE-200
Open these records in search →