TH
Product
Thunderbird
by Mozilla · last CVE Sep 30, 2026
On CISA KEVExploited in the wildRansomware-linked
2,073
CVEs
14
On KEV
10.0
Max CVSS
77
New 30D
Severity mix
Critical 379High 120Medium 1Low 0
Watch

Add Thunderbird to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-92020
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92017
8.8
0%
Sep 15
Privilege escalation in the DOM: Service Workers component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92016
8.8
0%
Sep 15
Use-after-free in the Disability Access APIs component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92015
8.8
0%
Sep 15
Privilege escalation in the WebExtensions component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92014
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics component
Affected: before 140.16.0
CVE-2026-92013
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92012
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92011
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92010
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92009
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92008
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92007
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-92006
8.8
0%
Sep 15
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.16.0; 141.0 before 153.3.0; 154.0 before 156.0
CVE-2026-84128
8.8
0%
Sep 1
Privilege escalation in the WebDriver BiDi component
Affected: before 155.0
CVE-2026-84123
8.8
0%
Sep 1
Privilege escalation due to use-after-free in the Graphics: WebGPU component
Affected: before 153.2.0; 154.0 before 155.0
CVE-2026-84131
8.8
0%
Sep 1
Privilege escalation due to invalid pointer in the Graphics component
Affected: before 140.15.0; 141.0 before 153.2.0; 154.0 before 155.0
CVE-2026-74955
8.8
0%
Aug 18
Privilege escalation in the Request Handling component
Affected: before 153.1.0; before 154.0
CVE-2026-74952
8.8
0%
Aug 18
Privilege escalation in the Application Update component
Affected: before 154.0
CVE-2026-74950
8.8
0%
Aug 18
Privilege escalation in the Downloads API component
Affected: before 153.1.0; before 154.0
CVE-2026-74947
8.8
0%
Aug 18
Privilege escalation due to invalid pointer in the Graphics component
Affected: before 153.1.0; before 154.0
CVE-2026-74937
8.8
0%
Aug 18
Use-after-free in the JavaScript: GC component
Affected: before 153.1.0; before 154.0
CVE-2026-74969
8.8
0%
Aug 18
Use-after-free in the Layout: Text and Fonts component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74965
8.8
0%
Aug 18
Privilege escalation in the Shell Integration component
Affected: before 140.14.0; before 154.0; 153.0 before 153.1.0
CVE-2026-74953
8.8
0%
Aug 18
Privilege escalation in the Networking: Cookies component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74949
8.8
0%
Aug 18
Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74946
8.8
0%
Aug 18
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74942
8.8
0%
Aug 18
Privilege escalation in the Remote Settings Client component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74941
8.8
0%
Aug 18
Privilege escalation in the Graphics: CanvasWebGL component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74939
8.8
0%
Aug 18
Privilege escalation in the DOM: Navigation component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-74935
8.8
0%
Aug 18
Privilege escalation in the DOM: Networking component
Affected: before 140.14.0; 141.0 before 153.1.0
CVE-2026-16401
8.8
0%
Jul 21
Privilege escalation in the Data Loss Prevention component
Affected: before 153.0
CVE-2026-16396
8.8
0%
Jul 21
Privilege escalation in WebExtensions
Affected: before 140.13.0; 141.0 before 153.0
CVE-2026-16379
8.8
0%
Jul 21
Privilege escalation in the DOM: Content Processes component
Affected: before 140.13.0; 141.0 before 153.0
CVE-2026-16372
8.8
0%
Jul 21
Privilege escalation in the DOM: Content Processes component
Affected: before 153.0
CVE-2026-16371
8.8
0%
Jul 21
Privilege escalation in the DOM: Navigation component
Affected: before 140.13.0; 141.0 before 153.0
CVE-2026-16366
8.8
0%
Jul 21
Privilege escalation in the DOM: Navigation component
Affected: before 153.0
CVE-2026-16365
8.8
0%
Jul 21
Privilege escalation in the DOM: Workers component
Affected: before 153.0
CVE-2026-16362
8.8
0%
Jul 21
Use-after-free in the WebRTC: Audio/Video component
Affected: before 140.13.0; 141.0 before 153.0
CVE-2026-12291
8.8
0%
Jun 16
Use-after-free in the Networking: HTTP component
Affected: before 140.12.0; before 152.0.0
CVE-2026-12289
8.8
0%
Jun 16
Privilege escalation in the Graphics: WebRender component
Affected: before 152.0.0; 140.0 before 140.12.0
CVE-2026-8975
8.8
0%
May 19
Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
Affected: before 140.11; before 151.0.0
CVE-2026-8974
8.8
0%
May 19
Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151
Affected: before 140.11; before 151.0.0
CVE-2026-8973
8.8
0%
May 19
Memory safety bugs fixed in Thunderbird 151
Affected: before 151.0.0
CVE-2026-8972
8.8
0%
May 19
Privilege escalation in the WebRTC: Audio/Video component
Affected: before 151.0.0
CVE-2026-8970
8.8
0%
May 19
Privilege escalation in the Security component
Affected: before 140.11; before 151.0.0
CVE-2026-8957
8.8
0%
May 19
Privilege escalation in the Enterprise Policies component
Affected: before 140.11; before 151.0.0
CVE-2026-8955
8.8
0%
May 19
Privilege escalation in the DOM: Workers component
Affected: before 140.11; before 151.0.0
CVE-2026-8952
8.8
0%
May 19
Privilege escalation in the Application Update component
Affected: before 151.0.0
CVE-2026-6769
8.8
0%
Apr 21
Privilege escalation in the Debugger component
Affected: before 140.10.0
CVE-2026-6761
8.8
0%
Apr 21
Privilege escalation in the Networking component
Affected: before 140.10.0
Page 10 of 10 · 500 total
1…910
The 500 most important CVEs for this product (exploited first, then by severity)