Mozilla Thunderbird vulnerabilities
2,511 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,511
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229
Vulnerabilities
Page 55 of 126
CVE-2026-84130P3HIGHCVSS 7.5fixed in 153.2.0≥ 154.0, < 155.02026-09-01
CVE-2026-84130 [HIGH] CWE-200 CVE-2026-84130: Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 15
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
nvdmozilla
CVE-2026-16374P3HIGHCVSS 7.5fixed in 140.13.0≥ 141.0, < 153.02026-07-21
CVE-2026-16374 [HIGH] CWE-200 CVE-2026-16374: Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firef
Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2026-16391P3HIGHCVSS 7.5fixed in 140.13.0≥ 141.0, < 153.02026-07-21
CVE-2026-16391 [HIGH] CWE-200 CVE-2026-16391: Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox
Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
nvdmozilla
CVE-2026-16384P3HIGHCVSS 7.5fixed in 153.02026-07-21
CVE-2026-16384 [HIGH] CWE-908 CVE-2026-16384: Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-16400P3HIGHCVSS 7.5fixed in 153.02026-07-21
CVE-2026-16400 [HIGH] CWE-200 CVE-2026-16400: Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 a
Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-16386P3HIGHCVSS 7.5fixed in 153.02026-07-21
CVE-2026-16386 [HIGH] CWE-908 CVE-2026-16386: Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2026-16385P3HIGHCVSS 7.5fixed in 153.02026-07-21
CVE-2026-16385 [HIGH] CWE-908 CVE-2026-16385: Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerabi
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
nvdmozilla
CVE-2013-5616P3CRITICALCVSS 9.8fixed in 24.22013-12-11
CVE-2013-5616 [CRITICAL] CWE-416 CVE-2013-5616: Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla F
Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to mListeners event listen
nvd
CVE-2026-6754P3HIGHCVSS 7.5fixed in 140.10.02026-04-21
CVE-2026-6754 [HIGH] CWE-416 CVE-2026-6754: Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Fire
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
nvdmozilla
CVE-2025-14327P3HIGHCVSS 7.5fixed in 146.02025-12-09
CVE-2025-14327 [HIGH] CWE-290 CVE-2025-14327: Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunde
Spoofing issue in the Downloads Panel component. This vulnerability was fixed in Firefox 146, Thunderbird 146, Firefox ESR 140.7, and Thunderbird 140.7.
nvdosv
CVE-2026-12305P3HIGHCVSS 7.5fixed in 140.12.0fixed in 152.0.02026-06-16
CVE-2026-12305 [HIGH] CWE-119 CVE-2026-12305: Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR
Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.
nvdmozilla
CVE-2026-2783P3HIGHCVSS 7.5fixed in 140.8.0fixed in 148.02026-02-24
CVE-2026-2783 [HIGH] CWE-843 CVE-2026-2783: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulne
Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
nvdosv
CVE-2026-8967P3HIGHCVSS 7.5fixed in 151.0.02026-05-19
CVE-2026-8967 [HIGH] CWE-200 CVE-2026-8967: Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 15
Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-8966P3HIGHCVSS 7.5fixed in 151.0.02026-05-19
CVE-2026-8966 [HIGH] CWE-200 CVE-2026-8966: Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 a
Information disclosure in the IP Protection component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-8965P3HIGHCVSS 7.5fixed in 151.0.02026-05-19
CVE-2026-8965 [HIGH] CWE-200 CVE-2026-8965: Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 a
Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-8963P3HIGHCVSS 7.5fixed in 151.0.02026-05-19
CVE-2026-8963 [HIGH] CWE-290 CVE-2026-8963: Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderb
Spoofing issue in the Web Speech component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-8964P3HIGHCVSS 7.5fixed in 151.0.02026-05-19
CVE-2026-8964 [HIGH] CWE-451 CVE-2026-8964: Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thund
Spoofing issue in the Popup Blocker component. This vulnerability was fixed in Firefox 151 and Thunderbird 151.
nvdmozilla
CVE-2026-2803P3HIGHCVSS 7.5fixed in 148.02026-02-24
CVE-2026-2803 [HIGH] CWE-200 CVE-2026-2803: Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
nvd
CVE-2024-6603P3HIGHCVSS 7.4fixed in 115.13≥ 116.0, < 128.0+2 more2024-07-09
CVE-2024-6603 [HIGH] CWE-823 CVE-2024-6603: In an out-of-memory scenario an allocation could fail but free would have been called on the pointer
In an out-of-memory scenario an allocation could fail but free would have been called on the pointer afterwards leading to memory corruption. This vulnerability affects Firefox < 128, Firefox ESR < 115.13, Thunderbird < 115.13, and Thunderbird < 128.
nvdosv
CVE-2026-84640P3HIGHCVSS 7.5fixed in 140.15.0≥ 141.0, < 153.2.0+1 more2026-09-01
CVE-2026-84640 [HIGH] CWE-126 CVE-2026-84640: A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This v
A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2.
nvdmozilla