Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: DuckDuckGo Clear all filters
TI-2025-30744 CVE-2025-48464 · GHSA-4v24-3w3q-g36w

Exposure of sensitive information in DuckDuckGo Browser

Priority LOW 21

Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim’s Sync account data such as account credentials and email protection information.

CVSS 3.1MEDIUM 4.7 Local No auth User interaction EPSS 0.00139 Published 2025-10-08 No fix listed CWE-200
TI-2020-12206 CVE-2020-15502 · GHSA-p7wp-4j7f-22g3

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS…

Priority LOW 36

The DuckDuckGo application through 5.58.0 for Android, and through 7.47.1.0 for iOS, sends hostnames of visited web sites within HTTPS .ico requests to servers in the duckduckgo.com domain, which might make visit data av…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01533 Published 2020-07-02 No fix listed CWE-200
TI-2018-04998 CVE-2018-6849 · GHSA-637h-2rp3-w54w

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to…

Priority MEDIUM 43

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request…

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.28713 Published 2018-04-01 No fix listed CWE-200