Mozilla Thunderbird vulnerabilities
2,511 known vulnerabilities affecting mozilla/thunderbird.
Total CVEs
2,511
CISA KEV
14
actively exploited
Public exploits
63
Exploited in wild
25
Severity breakdown
CRITICAL739HIGH767MEDIUM747LOW29UNKNOWN229
Vulnerabilities
Page 94 of 126
CVE-2026-84118P4MEDIUMCVSS 5.4fixed in 153.2.0≥ 154.0, < 155.02026-09-01
CVE-2026-84118 [MEDIUM] CWE-416 CVE-2026-84118: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
nvdmozilla
CVE-2026-109732P4MEDIUMCVSS 5.4fixed in Thunderbird 153.5
CVE-2026-109732 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109732
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-109732
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
mozilla
CVE-2026-109729P4MEDIUMCVSS 5.4fixed in Thunderbird 153.5
CVE-2026-109729 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109729
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-109729
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
mozilla
CVE-2026-109752P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109752 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109752
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109752
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109738P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109738 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109738
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109738
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109726P4MEDIUMCVSS 5.4fixed in Thunderbird 153.5
CVE-2026-109726 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109726
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-109726
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
mozilla
CVE-2026-109706P4MEDIUMCVSS 5.4fixed in Thunderbird 153.5
CVE-2026-109706 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109706
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-109706
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
mozilla
CVE-2026-109718P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109718 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109718
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109718
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109728P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109728 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109728
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109728
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109727P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109727 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109727
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109727
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109710P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109710 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109710
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109710
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109749P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109749 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109749
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109749
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109748P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109748 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109748
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109748
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109735P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109735 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109735
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109735
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109761P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109761 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109761
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109761
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109724P4MEDIUMCVSS 5.4fixed in Thunderbird 153.5
CVE-2026-109724 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109724
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-109724
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
mozilla
CVE-2026-109711P4MEDIUMCVSS 5.4fixed in Thunderbird 158
CVE-2026-109711 [MEDIUM] Mozilla Foundation Security Advisory 2026-109: CVE-2026-109711
Mozilla Foundation Security Advisory 2026-109
CVE: CVE-2026-109711
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 158
mozilla
CVE-2026-109717P4MEDIUMCVSS 5.4fixed in Thunderbird 153.5
CVE-2026-109717 [MEDIUM] Mozilla Foundation Security Advisory 2026-110: CVE-2026-109717
Mozilla Foundation Security Advisory 2026-110
CVE: CVE-2026-109717
Product: Thunderbird
Impact: low
Fixed in: Thunderbird 153.5
mozilla
CVE-2026-0886P4MEDIUMCVSS 5.3fixed in 140.7.0fixed in 147.02026-01-13
CVE-2026-0886 [MEDIUM] CWE-119 CVE-2026-0886: Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 147, Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.
nvdosv
CVE-2024-10460P4MEDIUMCVSS 5.3fixed in 128.4≥ 129, < 132+2 more2024-10-29
CVE-2024-10460 [MEDIUM] CWE-346 CVE-2024-10460: The origin of an external protocol handler prompt could have been obscured using a data: URL within
The origin of an external protocol handler prompt could have been obscured using a data: URL within an `iframe`. This vulnerability affects Firefox < 132, Firefox ESR < 128.4, Thunderbird < 128.4, and Thunderbird < 132.
nvdosv