Mozilla Thunderbird vulnerabilities
2,339 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,339
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH765MEDIUM746LOW29UNKNOWN60
Vulnerabilities
Page 24 of 117
CVE-2026-8970P3HIGHCVSS 8.8fixed in 140.11fixed in 151.0.02026-05-19
CVE-2026-8970 [HIGH] CWE-269 CVE-2026-8970: Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox
Privilege escalation in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
nvdmozilla
CVE-2026-92021P3HIGHCVSS 8.8fixed in 140.16.02026-09-15
CVE-2026-92021 [HIGH] CWE-416 CVE-2026-92021: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
nvdmozilla
CVE-2026-92015P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92015 [HIGH] CWE-269 CVE-2026-92015: Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Fi
Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-100782P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100782 [HIGH] CWE-119 CVE-2026-100782: Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerabil
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-92010P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92010 [HIGH] CWE-120 CVE-2026-92010: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92011P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92011 [HIGH] CWE-120 CVE-2026-92011: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92020P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92020 [HIGH] CWE-120 CVE-2026-92020: Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92012P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92012 [HIGH] CWE-120 CVE-2026-92012: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92007P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92007 [HIGH] CWE-120 CVE-2026-92007: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92009P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92009 [HIGH] CWE-120 CVE-2026-92009: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92013P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92013 [HIGH] CWE-120 CVE-2026-92013: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92008P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92008 [HIGH] CWE-120 CVE-2026-92008: Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. Th
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92017P3HIGHCVSS 8.8fixed in 140.16.0≥ 141.0, < 153.3.0+1 more2026-09-15
CVE-2026-92017 [HIGH] CWE-269 CVE-2026-92017: Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox
Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
nvdmozilla
CVE-2026-100815P3HIGHCVSS 8.8fixed in 153.4.0≥ 154.0, < 157.02026-09-29
CVE-2026-100815 [HIGH] CWE-416 CVE-2026-100815: Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
nvdmozilla
CVE-2026-100801P3HIGHCVSS 8.8fixed in 140.17.0≥ 141.0, < 153.4.0+1 more2026-09-29
CVE-2026-100801 [HIGH] CWE-269 CVE-2026-100801: Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.
Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140.17.
nvdmozilla
CVE-2026-100825P3HIGHCVSS 8.8fixed in 153.4.0≥ 154.0, < 157.02026-09-29
CVE-2026-100825 [HIGH] CWE-416 CVE-2026-100825: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
nvdmozilla
CVE-2026-92058P3HIGHCVSS 8.8fixed in 153.3.0≥ 154.0, < 156.02026-09-15
CVE-2026-92058 [HIGH] CWE-416 CVE-2026-92058: Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 1
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92049P3HIGHCVSS 8.8fixed in 153.3.0≥ 154.0, < 156.02026-09-15
CVE-2026-92049 [HIGH] CWE-416 CVE-2026-92049: Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92056P3HIGHCVSS 8.8fixed in 153.3.0≥ 154.0, < 156.02026-09-15
CVE-2026-92056 [HIGH] CWE-416 CVE-2026-92056: Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
nvdmozilla
CVE-2026-92060P3HIGHCVSS 8.8fixed in 153.3.0≥ 154.0, < 156.02026-09-15
CVE-2026-92060 [HIGH] CWE-416 CVE-2026-92060: Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, F
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
nvdmozilla