Mozilla Thunderbird
1711 published vulnerabilities name this product. The 200 most recent are listed.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118180 | fixed in 153.6, 159 | Matrix homeserver could redirect the chat session to a local file or network share | ||||
| CVE-2026-118179 | fixed in 153.6, 159 | Request forgery via news: links | ||||
| CVE-2026-118178 | fixed in 153.6, 159 | RSS feed could redirect its subscription to a local file or network share | ||||
| CVE-2026-118177 | fixed in 153.6, 159 | Calendar discovery accepted local file and remote network share locations | ||||
| CVE-2026-118176 | fixed in 153.6, 159 | Bypass of remote UNC path restriction in mailbox: URLs | ||||
| CVE-2026-118175 | fixed in 153.6, 159 | Content of other messages could be included when replying to a crafted message | ||||
| CVE-2026-118174 | fixed in 153.6, 159 | Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment | ||||
| CVE-2026-118026 | fixed in 159 | Invalid pointer in the JavaScript: GC component | ||||
| CVE-2026-118025 | fixed in 159 | Other issue in the SVG component | ||||
| CVE-2026-118024 | fixed in 159 | Use-after-free in the Graphics: Text component | ||||
| CVE-2026-118023 | fixed in 159 | Sandbox escape due to use-after-free in the Graphics: WebRender component | ||||
| CVE-2026-118022 | fixed in 159 | Sandbox escape due to use-after-free in the Disability Access APIs component | ||||
| CVE-2026-118021 | fixed in 159 | Sandbox escape due to use-after-free in the XPCOM component | ||||
| CVE-2026-118020 | fixed in 159 | Use-after-free in the Layout component | ||||
| CVE-2026-118019 | fixed in 159 | Race condition, use-after-free in the DOM: File component | ||||
| CVE-2026-118017 | fixed in 159 | Use-after-free in the SVG component | ||||
| CVE-2026-118016 | fixed in 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-118015 | fixed in 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-118014 | fixed in 159 | Use-after-free in the JavaScript Engine: JIT component | ||||
| CVE-2026-118013 | fixed in 159 | Use-after-free in the Layout: Images, Video, and HTML Frames component | ||||
| CVE-2026-118012 | fixed in 159 | Use-after-free in the DOM: Animation component | ||||
| CVE-2026-118011 | fixed in 159 | Frame poisoning in the CSS Parsing and Computation component | ||||
| CVE-2026-118010 | fixed in 159 | Use-after-free in the Disability Access APIs component | ||||
| CVE-2026-118009 | fixed in 159 | Integer overflow, use-after-free in the Graphics: Text component | ||||
| CVE-2026-118008 | fixed in 159 | Privilege escalation in the DOM: Navigation component | HIGH 8.8 | |||
| CVE-2026-118007 | fixed in 159 | Use-after-free in the JavaScript: GC component | ||||
| CVE-2026-118006 | fixed in 159 | Privilege escalation due to use-after-free in the WebRTC: Signaling component | ||||
| CVE-2026-118005 | fixed in 159 | Use-after-free in the WebRTC: Signaling component | ||||
| CVE-2026-118004 | fixed in 153.6, 159 | Incorrect boundary conditions in the CSS Transitions and Animations component | ||||
| CVE-2026-118003 | fixed in 153.6, 159 | Information disclosure in the Networking: DNS component | ||||
| CVE-2026-118002 | fixed in 153.6, 159 | Information disclosure due to race condition in the Networking component | ||||
| CVE-2026-118000 | fixed in 153.6, 159 | Information disclosure in the Networking: HTTP component | ||||
| CVE-2026-117999 | fixed in 153.6, 159 | Race condition in the IPC component | ||||
| CVE-2026-117998 | fixed in 153.6, 159 | Mitigation bypass in the DOM: Push Subscriptions component | ||||
| CVE-2026-117997 | fixed in 153.6, 159 | Sandbox escape due to use-after-free in the Widget component | ||||
| CVE-2026-117996 | fixed in 153.6, 159 | Incorrect boundary conditions in the WebRTC component | ||||
| CVE-2026-117995 | fixed in 153.6, 159 | Privilege escalation in the DOM: UI Events & Focus Handling component | ||||
| CVE-2026-117994 | fixed in 153.6, 159 | Use-after-free in the JavaScript: GC component | ||||
| CVE-2026-117993 | fixed in 153.6, 159 | Integer overflow in the Graphics: Text component | ||||
| CVE-2026-117992 | fixed in 153.6, 159 | Information disclosure in the CSS Parsing and Computation component | ||||
| CVE-2026-117991 | fixed in 153.6, 159 | Incorrect boundary conditions in the Layout: Text and Fonts component | ||||
| CVE-2026-117990 | fixed in 153.6, 159 | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component | ||||
| CVE-2026-117989 | fixed in 153.6, 159 | Use-after-free in the Graphics component | ||||
| CVE-2026-117988 | fixed in 153.6, 159 | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | ||||
| CVE-2026-117987 | fixed in 153.6, 159 | Use-after-free in the Graphics component | ||||
| CVE-2026-117986 | fixed in 153.6, 159 | Use-after-free in the Graphics component | ||||
| CVE-2026-117985 | fixed in 153.6, 159 | Sandbox escape due to use-after-free in the Graphics component | ||||
| CVE-2026-117984 | fixed in 153.6, 159 | Incorrect boundary conditions in the Layout: Scrolling and Overflow component | ||||
| CVE-2026-117983 | fixed in 153.6, 159 | Use-after-free in the Graphics component | ||||
| CVE-2026-117982 | fixed in 153.6, 159 | Invalid pointer in the JavaScript Engine: JIT component | ||||
| CVE-2026-117981 | fixed in 153.6, 159 | Privilege escalation in the Toolkit component | ||||
| CVE-2026-117980 | fixed in 153.6, 159 | Use-after-free in the Graphics component | ||||
| CVE-2026-117979 | fixed in 153.6, 159 | Incorrect boundary conditions in the Graphics: WebRender component | ||||
| CVE-2026-117978 | fixed in 153.6, 159 | Incorrect boundary conditions in the Graphics component | ||||
| CVE-2026-117977 | fixed in 153.6, 159 | Other issue in the Console component | ||||
| CVE-2026-117976 | fixed in 153.6, 159 | Site isolation issue in the DOM: Navigation component | ||||
| CVE-2026-117975 | fixed in 153.6, 159 | Sandbox escape due to invalid pointer in the Graphics: WebRender component | ||||
| CVE-2026-117974 | fixed in 153.6, 159 | Use-after-free in the XML component | ||||
| CVE-2026-117973 | fixed in 153.6, 159 | Use-after-free in the Networking: DNS component | ||||
| CVE-2026-117972 | fixed in 153.6, 159 | Use-after-free in the Graphics component | ||||
| CVE-2026-117971 | fixed in 153.6, 159 | Sandbox escape due to use-after-free in the Print Preview component | ||||
| CVE-2026-117970 | fixed in 153.6, 159 | Race condition in the Disability Access APIs component | ||||
| CVE-2026-117969 | fixed in 153.6, 159 | Invalid pointer in the JavaScript Engine: JIT component | ||||
| CVE-2026-117968 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117967 | fixed in 153.6, 159 | Mitigation bypass in the DOM: Security component | ||||
| CVE-2026-117966 | fixed in 153.6, 159 | Site isolation issue in the Networking: HTTP component | ||||
| CVE-2026-117965 | fixed in 153.6, 159 | Same-origin policy bypass in the Address Bar component | ||||
| CVE-2026-117964 | fixed in 153.6, 159 | Use-after-free in the Panning and Zooming component | ||||
| CVE-2026-117963 | fixed in 153.6, 159 | Incorrect boundary conditions in the DOM: Service Workers component | ||||
| CVE-2026-117962 | fixed in 153.6, 159 | Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component | ||||
| CVE-2026-117961 | fixed in 153.6, 159 | Incorrect boundary conditions in the Layout: Text and Fonts component | ||||
| CVE-2026-117960 | fixed in 153.6, 159 | Spoofing issue in the DOM: Core & HTML component | ||||
| CVE-2026-117959 | fixed in 153.6, 159 | Site isolation issue in the DOM: Service Workers component | ||||
| CVE-2026-117958 | fixed in 153.6, 159 | Site isolation issue in the Networking: HTTP component | ||||
| CVE-2026-117957 | fixed in 153.6, 159 | Cryptographic issue in the WebRTC: Networking component | ||||
| CVE-2026-117956 | fixed in 153.6, 159 | Invalid pointer in the Nimbus Desktop Client component | ||||
| CVE-2026-117955 | fixed in 153.6, 159 | JIT miscompilation in the JavaScript: WebAssembly component | ||||
| CVE-2026-117954 | fixed in 153.6, 159 | Use-after-free in the Layout: Positioned component | ||||
| CVE-2026-117953 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117952 | fixed in 153.6, 159 | Uninitialized memory in the Networking component | ||||
| CVE-2026-117951 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117950 | fixed in 153.6, 159 | Incorrect boundary conditions in the DOM: Core & HTML component | ||||
| CVE-2026-117949 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117948 | fixed in 153.6, 159 | Use-after-free in the SVG component | ||||
| CVE-2026-117947 | fixed in 153.6, 159 | Use-after-free in the XML component | ||||
| CVE-2026-117946 | fixed in 153.6, 159 | Incorrect boundary conditions in the JavaScript Engine component | ||||
| CVE-2026-117945 | fixed in 153.6, 159 | Incorrect boundary conditions in the XML component | ||||
| CVE-2026-117944 | fixed in 153.6, 159 | Use-after-free in the Layout component | ||||
| CVE-2026-117943 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117942 | fixed in 153.6, 159 | Incorrect boundary conditions in the JavaScript Engine: JIT component | ||||
| CVE-2026-117941 | fixed in 153.6, 159 | Use-after-free in the DOM: CSS Object Model component | ||||
| CVE-2026-117940 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117939 | fixed in 153.6, 159 | Use-after-free in the XML component | ||||
| CVE-2026-117938 | fixed in 153.6, 159 | Use-after-free in the Layout component | ||||
| CVE-2026-117937 | fixed in 153.6, 159 | Invalid pointer in the JavaScript Engine component | ||||
| CVE-2026-117936 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117935 | fixed in 153.6, 159 | Use-after-free in the DOM: Bindings (WebIDL) component | ||||
| CVE-2026-117934 | fixed in 153.6, 159 | Use-after-free in the Layout component | ||||
| CVE-2026-117933 | fixed in 153.6, 159 | Frame poisoning in the CSS Parsing and Computation component | ||||
| CVE-2026-117932 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117931 | fixed in 153.6, 159 | Use-after-free in the DOM: Events component | ||||
| CVE-2026-117930 | fixed in 153.6, 159 | Use-after-free in the DOM: Bindings (WebIDL) component | ||||
| CVE-2026-117929 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117928 | fixed in 153.6, 159 | Same-origin policy bypass in the CSS Parsing and Computation component | ||||
| CVE-2026-117927 | fixed in 153.6, 159 | Use-after-free in the SVG component | ||||
| CVE-2026-117926 | fixed in 153.6, 159 | Incorrect boundary conditions in the SVG component | ||||
| CVE-2026-117925 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117924 | fixed in 153.6, 159 | Use-after-free in the XSLT component | ||||
| CVE-2026-117923 | fixed in 153.6, 159 | Use-after-free in the Audio/Video component | ||||
| CVE-2026-117922 | fixed in 153.6, 159 | Use-after-free in the Networking: WebSockets component | ||||
| CVE-2026-117921 | fixed in 153.6, 159 | Use-after-free in the CSS Parsing and Computation component | ||||
| CVE-2026-117920 | fixed in 153.6, 159 | Use-after-free in the DOM: HTML Parser component | ||||
| CVE-2026-117919 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117918 | fixed in 153.6, 159 | Use-after-free in the Graphics: Canvas2D component | ||||
| CVE-2026-117917 | fixed in 153.6, 159 | Invalid pointer in the Graphics: WebRender component | ||||
| CVE-2026-117916 | fixed in 153.6, 159 | Use-after-free in the XSLT component | ||||
| CVE-2026-117915 | fixed in 153.6, 159 | Incorrect boundary conditions in the Layout: Block and Inline component | ||||
| CVE-2026-117914 | fixed in 153.6, 159 | Use-after-free in the SVG component | ||||
| CVE-2026-117913 | fixed in 153.6, 159 | Use-after-free in the SVG component | ||||
| CVE-2026-117912 | fixed in 153.6, 159 | Same-origin policy bypass in the CSS Parsing and Computation component | ||||
| CVE-2026-117911 | fixed in 153.6, 159 | Use-after-free in the Audio/Video: Playback component | ||||
| CVE-2026-117910 | fixed in 153.6, 159 | Invalid pointer in the JavaScript Engine component | ||||
| CVE-2026-117909 | fixed in 153.6, 159 | Use-after-free in the JavaScript: GC component | ||||
| CVE-2026-117908 | fixed in 153.6, 159 | Use-after-free in the Graphics: ImageLib component | ||||
| CVE-2026-117907 | fixed in 153.6, 159 | Use-after-free in the Networking component | ||||
| CVE-2026-117906 | fixed in 153.6, 159 | Use-after-free in the CSS Parsing and Computation component | ||||
| CVE-2026-117905 | fixed in 153.6, 159 | Use-after-free in the Audio/Video: Playback component | ||||
| CVE-2026-117904 | fixed in 153.6, 159 | Use-after-free in the JavaScript: GC component | ||||
| CVE-2026-117903 | fixed in 153.6, 159 | Use-after-free in the Audio/Video component | ||||
| CVE-2026-117902 | fixed in 153.6, 159 | Use-after-free in the Layout: Text and Fonts component | ||||
| CVE-2026-117901 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117900 | fixed in 153.6, 159 | Use-after-free in the DOM: Editor component | ||||
| CVE-2026-117899 | fixed in 153.6, 159 | Use-after-free in the Networking: HTTP component | ||||
| CVE-2026-117898 | fixed in 153.6, 159 | Use-after-free in the JavaScript Engine: JIT component | ||||
| CVE-2026-117897 | fixed in 153.6, 159 | Incorrect boundary conditions in the Layout: Tables component | ||||
| CVE-2026-117896 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117895 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117894 | fixed in 153.6, 159 | Incorrect boundary conditions in the WebRTC: Signaling component | ||||
| CVE-2026-117893 | fixed in 153.6, 159 | Incorrect boundary conditions in the Security: PSM component | ||||
| CVE-2026-117892 | fixed in 153.6, 159 | Privilege escalation due to use-after-free in the WebRTC: Networking component | ||||
| CVE-2026-117891 | fixed in 153.6, 159 | Use-after-free in the JavaScript Engine: JIT component | ||||
| CVE-2026-117890 | fixed in 153.6, 159 | JIT miscompilation in the JavaScript Engine: JIT component | ||||
| CVE-2026-117889 | fixed in 153.6, 159 | Incorrect boundary conditions in the JavaScript Engine component | ||||
| CVE-2026-117888 | fixed in 153.6, 159 | Uninitialized memory in the Graphics: Canvas2D component | ||||
| CVE-2026-117887 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117886 | fixed in 153.6, 159 | Incorrect boundary conditions in the Graphics: Text component | ||||
| CVE-2026-117885 | fixed in 153.6, 159 | Use-after-free in the Layout: Grid component | ||||
| CVE-2026-117884 | fixed in 153.6, 159 | Use-after-free in the Networking component | ||||
| CVE-2026-117883 | fixed in 153.6, 159 | Use-after-free in the DOM: HTML Parser component | ||||
| CVE-2026-117882 | fixed in 153.6, 159 | Use-after-free in the Layout component | ||||
| CVE-2026-117881 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117880 | fixed in 153.6, 159 | Use-after-free in the XML component | ||||
| CVE-2026-117879 | fixed in 153.6, 159 | Incorrect boundary conditions in the Layout: Tables component | ||||
| CVE-2026-117878 | fixed in 153.6, 159 | Other issue, use-after-free in the Storage: IndexedDB component | ||||
| CVE-2026-117877 | fixed in 153.6, 159 | Use-after-free in the Layout: Text and Fonts component | ||||
| CVE-2026-117876 | fixed in 153.6, 159 | Use-after-free in the Layout: Text and Fonts component | ||||
| CVE-2026-117875 | fixed in 153.6, 159 | Use-after-free in the Layout: Scrolling and Overflow component | ||||
| CVE-2026-117874 | fixed in 153.6, 159 | Use-after-free in the Internationalization component | ||||
| CVE-2026-117873 | fixed in 153.6, 159 | Incorrect boundary conditions in the Audio/Video: Playback component | ||||
| CVE-2026-117872 | fixed in 153.6, 159 | Use-after-free in the JavaScript: Standard Library component | ||||
| CVE-2026-117871 | fixed in 153.6, 159 | Invalid pointer in the Graphics component | ||||
| CVE-2026-117870 | fixed in 153.6, 159 | Use-after-free in the JavaScript Engine component | ||||
| CVE-2026-117869 | fixed in 153.6, 159 | Use-after-free in the DOM: Core & HTML component | ||||
| CVE-2026-117868 | fixed in 153.6, 159 | Sandbox escape in the DOM: Networking component | ||||
| CVE-2026-117867 | fixed in 153.6, 159 | Use-after-free in the Layout component | ||||
| CVE-2026-117866 | fixed in 153.6, 159 | Privilege escalation due to use-after-free in the Graphics: Canvas2D component | ||||
| CVE-2026-117865 | fixed in 153.6, 159 | Use-after-free in the JavaScript: GC component | ||||
| CVE-2026-117864 | fixed in 153.6, 159 | Sandbox escape in the Form Manager component | ||||
| CVE-2026-117863 | fixed in 153.6, 159 | Information disclosure due to uninitialized memory in the Audio/Video component | ||||
| CVE-2026-117862 | fixed in 153.6, 159 | Privilege escalation due to incorrect boundary conditions in the Networking component | ||||
| CVE-2026-117861 | fixed in 153.6, 159 | Sandbox escape in the DOM: Navigation component | ||||
| CVE-2026-117860 | fixed in 153.6, 159 | Same-origin policy bypass in the DOM: Navigation component | ||||
| CVE-2026-113869 | fixed in 153.6, 158.0.1 | Use-after-free in S/MIME decryption during a security device password prompt | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-113868 | fixed in 153.5.1, 158.0.1 | Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-113867 | fixed in 153.5.1, 158.0.1 | Stanza injection in XMPP chat | 0.2 % | |||
| CVE-2026-113866 | fixed in 153.5.1, 158.0.1 | Account password sent unencrypted during Exchange account setup | MEDIUM 5.9 | 0.4 % | ||
| CVE-2026-113401 | fixed in 158.0.1 | Denial-of-service in the PDF Viewer component | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-113400 | fixed in 158.0.1 | Uninitialized memory in the Audio/Video: cubeb component | MEDIUM 5.4 | 0.3 % | ||
| CVE-2026-113470 | fixed in 153.5.1, 158.0.1 | Cryptographic issue in the Security Block-lists, Allow-lists, and other State component | MEDIUM 5.4 | 0.5 % | ||
| CVE-2026-113399 | fixed in 158.0.1 | Incorrect boundary conditions in the SVG component | 0.2 % | |||
| CVE-2026-110249 | fixed in 153.5, 158 | Denial-of-service in the Exchange email component | HIGH 8.6 | 0.2 % | ||
| CVE-2026-110247 | fixed in 153.6, 158 | Integer overflow in libmime buffer growth could lead to heap corruption | HIGH 8.4 | 0.2 % | ||
| CVE-2026-109783 | fixed in 153.5 | Mitigation bypass in the File Handling component | HIGH 8.3 | 0.3 % | ||
| CVE-2026-109782 | fixed in 153.5 | Mitigation bypass in the File Handling component | HIGH 8.3 | 0.3 % | ||
| CVE-2026-109781 | fixed in 153.5, 158 | Denial-of-service in the Printing: Output component | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-109780 | fixed in 158 | Mitigation bypass in the DOM: Core & HTML component | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-109779 | fixed in 158 | Race condition in the Networking: DNS component | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-109778 | fixed in 153.5, 158 | Privilege escalation in the WebExtensions component | HIGH 8.8 | 0.3 % | ||
| CVE-2026-109777 | fixed in 153.5, 158 | Information disclosure in the Storage: IndexedDB component | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-109776 | fixed in 153.5, 158 | Race condition in the XPCOM component | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-109775 | fixed in 153.5, 158 | Denial-of-service in the WebRTC component | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-109774 | fixed in 158 | Invalid pointer, undefined behavior in the DOM: Notifications component | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-109773 | fixed in 158 | Denial-of-service in the Sync component | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-109772 | fixed in 158 | Same-origin policy bypass in the DevTools component | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-109771 | fixed in 158 | Information disclosure in the WebRTC: Networking component | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-109770 | fixed in 153.5, 158 | Spoofing issue in the DOM: Web Serial component | MEDIUM 6.1 | 0.2 % | ||
| CVE-2026-109769 | fixed in 158 | Information disclosure in the Networking: Cache component | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-109768 | fixed in 158 | Denial-of-service in the Site Reports component | MEDIUM 6.5 | 0.2 % | ||
| CVE-2026-109767 | fixed in 153.5, 158 | Information disclosure in the Networking component | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-109766 | fixed in 153.5, 158 | Mitigation bypass in the Enterprise Policies component | HIGH 8.1 | 0.3 % |