Mozilla Thunderbird vulnerabilities
2,511 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,511
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229
Vulnerabilities
Page 101 of 126
CVE-2026-117891P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117891 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117891
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117891
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117892P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117892 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117892
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117892
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117974P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117974 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117974
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117974
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117880P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117880 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117880
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117880
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117870P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117870 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117870
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117870
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-109770P4UNKNOWNfixed in Thunderbird 158
CVE-2026-109770 Mozilla Foundation Security Advisory 2026-109: CVE-2026-109770
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109770
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-117970P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117970 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117970
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117970
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117959P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117959 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117959
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117959
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117890P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117890 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117890
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117890
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117961P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117961 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117961
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117961
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117898P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117898 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117898
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117898
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117984P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117984 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117984
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117984
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117991P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117991 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117991
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117991
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-117947P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117947 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117947
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117947
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117976P4UNKNOWNfixed in Thunderbird 153.6
CVE-2026-117976 Mozilla Foundation Security Advisory 2026-122: CVE-2026-117976
Mozilla Foundation Security Advisory 2026-122
CVE: CVE-2026-117976
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.6
mozilla
CVE-2026-117864P4UNKNOWNfixed in Thunderbird 159
CVE-2026-117864 Mozilla Foundation Security Advisory 2026-121: CVE-2026-117864
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-117864
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-118007P4UNKNOWNfixed in Thunderbird 159
CVE-2026-118007 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118007
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-118007
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2026-118022P4UNKNOWNfixed in Thunderbird 159
CVE-2026-118022 Mozilla Foundation Security Advisory 2026-121: CVE-2026-118022
Mozilla Foundation Security Advisory 2026-121
CVE: CVE-2026-118022
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 159
mozilla
CVE-2016-9895P4MEDIUMCVSS 6.1fixed in 45.6.0≥ unspecified, < 45.62018-06-11
CVE-2016-9895 [MEDIUM] CWE-254 CVE-2016-9895: Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) th
Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vulnerability affects Firefox < 50.1, Firefox ESR < 45.6, and Thunderbird < 45.6.
nvd
CVE-2017-5466P4MEDIUMCVSS 6.1fixed in 52.1.0≥ unspecified, < 52.12018-06-11
CVE-2017-5466 [MEDIUM] CWE-79 CVE-2017-5466: If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:tex
If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page with its origin set incorrectly. This allows for a cross-site scripting (XSS) attack. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
nvdosv