cbcvebase.

Mozilla Thunderbird vulnerabilities

2,511 known vulnerabilities affecting mozilla/thunderbird.

Total CVEs
2,511
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229

Vulnerabilities

Page 28 of 126
CVE-2024-7520P3HIGHCVSS 8.8fixed in 128.1.0≥ unspecified, < 128.12024-08-06
CVE-2024-7520 [HIGH] CWE-843 CVE-2024-7520: A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code ex A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution. This vulnerability affects Firefox < 129, Firefox ESR < 128.1, and Thunderbird < 128.1.
nvd
CVE-2024-0751P3HIGHCVSS 8.8fixed in 115.7≥ unspecified, < 115.72024-01-23
CVE-2024-0751 [HIGH] CWE-269 CVE-2024-0751: A malicious devtools extension could have been used to escalate privileges. This vulnerability affec A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7.
nvdosv
CVE-2024-10467P3HIGHCVSS 8.8fixed in 128.4.0≥ 129.0, < 132.0+2 more2024-10-29
CVE-2024-10467 [HIGH] CWE-787 CVE-2024-10467: Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these b Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
nvdosv
CVE-2024-7521P3HIGHCVSS 8.8fixed in 115.14.0v128.0.1+2 more2024-08-06
CVE-2024-7521 [HIGH] CWE-755 CVE-2024-7521: Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affe Incomplete WebAssembly exception handing could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
nvdosv
CVE-2013-0782P3CRITICALCVSS 9.3fixed in 17.0.32013-02-19
CVE-2013-0782 [CRITICAL] CWE-787 CVE-2013-0782: Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox b Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.
nvd
CVE-2024-7527P3HIGHCVSS 8.8fixed in 115.14.0v128.0.1+2 more2024-08-06
CVE-2024-7527 [HIGH] CWE-416 CVE-2024-7527: Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerabil Unexpected marking work at the start of sweeping could have led to a use-after-free. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunderbird < 128.1, and Thunderbird < 115.14.
nvdosv
CVE-2013-0760P3CRITICALCVSS 9.3fixed in 17.0.22013-01-13
CVE-2013-0760 [CRITICAL] CWE-120 CVE-2013-0760: Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18 Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.
nvd
CVE-2026-6750P3HIGHCVSS 8.8fixed in 140.10.02026-04-21
CVE-2026-6750 [HIGH] CWE-269 CVE-2026-6750: Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 1 Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
nvdmozilla
CVE-2026-0882P3HIGHCVSS 8.8fixed in 140.7.0fixed in 147.02026-01-13
CVE-2026-0882 [HIGH] CWE-416 CVE-2026-0882: Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32 Use-after-free in the IPC component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
nvdosv
CVE-2026-74947P3HIGHCVSS 8.8fixed in 153.1.0fixed in 154.02026-08-18
CVE-2026-74947 [HIGH] CWE-763 CVE-2026-74947: Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74953P3HIGHCVSS 8.8fixed in 140.14.0≥ 141.0, < 153.1.02026-08-18
CVE-2026-74953 [HIGH] CWE-269 CVE-2026-74953: Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 1 Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-74965P3HIGHCVSS 8.8fixed in 140.14.0fixed in 154.0+1 more2026-08-18
CVE-2026-74965 [HIGH] CWE-269 CVE-2026-74965: Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154 Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
nvdmozilla
CVE-2026-16371P3HIGHCVSS 8.8fixed in 140.13.0≥ 141.0, < 153.02026-07-21
CVE-2026-16371 [HIGH] CWE-269 CVE-2026-16371: Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
nvdmozilla
CVE-2026-92040P3HIGHCVSS 8.8fixed in 156.02026-09-15
CVE-2026-92040 [HIGH] CWE-416 CVE-2026-92040: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
nvdmozilla
CVE-2026-74952P3HIGHCVSS 8.8fixed in 154.02026-08-18
CVE-2026-74952 [HIGH] CWE-269 CVE-2026-74952: Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 15 Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
nvdmozilla
CVE-2026-8952P3HIGHCVSS 8.8fixed in 151.0.02026-05-19
CVE-2026-8952 [HIGH] CWE-269 CVE-2026-8952: Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 15 Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-84131P3HIGHCVSS 8.8fixed in 140.15.0≥ 141.0, < 153.2.0+1 more2026-09-01
CVE-2026-84131 [HIGH] CWE-763 CVE-2026-84131: Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
nvdmozilla
CVE-2024-5696P3HIGHCVSS 8.6fixed in 115.12≥ unspecified, < 115.122024-06-11
CVE-2024-5696 [HIGH] CWE-787 CVE-2024-5696: By manipulating the text in an `&lt;input&gt;` tag, an attacker could have caused corrupt memory lea By manipulating the text in an ` ` tag, an attacker could have caused corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
nvdosv
CVE-2026-100768P3HIGHCVSS 8.8fixed in 157.02026-09-29
CVE-2026-100768 [HIGH] CWE-416 CVE-2026-100768: Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 an Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
nvdmozilla
CVE-2026-100796P3HIGHCVSS 8.8fixed in 157.02026-09-29
CVE-2026-100796 [HIGH] CWE-416 CVE-2026-100796: Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
nvdmozilla
← Previous28 / 126Next →
Mozilla Thunderbird vulnerabilities | cvebase