TH
Product
Thunderbird
On CISA KEVExploited in the wildRansomware-linked
2,073
CVEs
14
On KEV
10.0
Max CVSS
77
New 30D
Severity mix
Critical 379High 120Medium 1Low 0
Watch
Add Thunderbird to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-16387 | 9.8 | Jul 21 | Site isolation issue in the Networking component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16383 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Networking component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16382 | 9.8 | Jul 21 | Mitigation bypass in the DOM: Service Workers component Affected: before 153.0 |
| CVE-2026-16358 | 9.8 | Jul 21 | Site isolation issue in the Graphics: WebRender component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16377 | 9.8 | Jul 21 | Mitigation bypass in the PDF Viewer component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16375 | 9.8 | Jul 21 | Site isolation issue in the Networking: HTTP component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16357 | 9.8 | Jul 21 | Incorrect boundary conditions in the Graphics component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16356 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the Disability Access APIs component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16355 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript Engine: JIT component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16369 | 9.8 | Jul 21 | Integer overflow in the JavaScript: WebAssembly component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16368 | 9.8 | Jul 21 | Incorrect boundary conditions in the JavaScript: WebAssembly component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16353 | 9.8 | Jul 21 | Invalid pointer in the DOM: Bindings (WebIDL) component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16363 | 9.8 | Jul 21 | JIT miscompilation in the JavaScript: WebAssembly component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16352 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the Disability Access APIs component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16351 | 9.8 | Jul 21 | Sandbox escape due to use-after-free in the DOM: Navigation component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16350 | 9.8 | Jul 21 | Incorrect boundary conditions in the Audio/Video: cubeb component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16349 | 9.8 | Jul 21 | Same-origin policy bypass in the DOM: Navigation component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-12293 | 9.8 | Jun 16 | Use-after-free in the Graphics: WebGPU component Affected: before 152.0.0 |
| CVE-2026-8956 | 9.8 | May 19 | Integer overflow in the Networking: JAR component Affected: before 140.11; before 151.0.0 |
| CVE-2026-8094 | 9.8 | May 7 | Other issue in the WebRTC component Affected: before 140.10.2 |
| CVE-2026-8091 | 9.8 | May 7 | Incorrect boundary conditions in the Audio/Video: Playback component Affected: 140.0 before 140.10.1 |
| CVE-2026-6771 | 9.8 | Apr 21 | Mitigation bypass in the DOM: Security component Affected: 140.0 before 140.10.0 |
| CVE-2026-6768 | 9.8 | Apr 21 | Mitigation bypass in the Networking: Cookies component Affected: before 150.0 |
| CVE-2026-6760 | 9.8 | Apr 21 | Mitigation bypass in the Networking: Cookies component Affected: before 150.0 |
| CVE-2026-6748 | 9.8 | Apr 21 | Uninitialized memory in the Audio/Video: Web Codecs component Affected: before 140.10.0 |
| CVE-2026-5735 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2 Affected: before 149.0.2 |
| CVE-2026-5734 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 Affected: before 140.9.1; before 149.0.2 |
| CVE-2026-5731 | 9.8 | Apr 7 | Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 Affected: 140.9.0; 149.0.1 |
| CVE-2026-4721 | 9.8 | Mar 24 | Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 Affected: before 140.9.0; before 149.0 |
| CVE-2026-4729 | 9.8 | Mar 24 | Memory safety bugs fixed in Firefox 149 and Thunderbird 149 Affected: before 149.0 |
| CVE-2026-4720 | 9.8 | Mar 24 | Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 Affected: before 140.9.0; before 149.0 |
| CVE-2026-4710 | 9.8 | Mar 24 | Incorrect boundary conditions in the Audio/Video component Affected: before 140.9.0; before 149.0 |
| CVE-2026-2807 | 9.8 | Feb 24 | Memory safety bugs fixed in Firefox 148 and Thunderbird 148 Affected: before 148.0 |
| CVE-2026-2805 | 9.8 | Feb 24 | Invalid pointer in the DOM: Core & HTML component Affected: before 148.0 |
| CVE-2026-2800 | 9.8 | Feb 24 | Spoofing issue in the WebAuthn component in Firefox for Android Affected: before 148.0 |
| CVE-2026-2799 | 9.8 | Feb 24 | Use-after-free in the DOM: Core & HTML component Affected: before 148.0 |
| CVE-2026-2797 | 9.8 | Feb 24 | Use-after-free in the JavaScript: GC component Affected: before 148.0 |
| CVE-2026-2796 | 9.8 | Feb 24 | JIT miscompilation in the JavaScript: WebAssembly component Affected: before 148.0 |
| CVE-2026-2795 | 9.8 | Feb 24 | Use-after-free in the JavaScript: GC component Affected: before 148.0 |
| CVE-2026-2793 | 9.8 | Feb 24 | Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 Affected: before 140.8.0; before 148.0 |
| CVE-2026-2792 | 9.8 | Feb 24 | Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 Affected: before 140.8.0; before 148.0 |
| CVE-2026-2791 | 9.8 | Feb 24 | Mitigation bypass in the Networking: Cache component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2790 | 9.8 | Feb 24 | Same-origin policy bypass in the Networking: JAR component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2789 | 9.8 | Feb 24 | Use-after-free in the Graphics: ImageLib component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2788 | 9.8 | Feb 24 | Incorrect boundary conditions in the Audio/Video: GMP component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2787 | 9.8 | Feb 24 | Use-after-free in the DOM: Window and Location component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2786 | 9.8 | Feb 24 | Use-after-free in the JavaScript Engine component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2785 | 9.8 | Feb 24 | Invalid pointer in the JavaScript Engine component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2784 | 9.8 | Feb 24 | Mitigation bypass in the DOM: Security component Affected: before 140.8.0; before 148.0 |
| CVE-2026-2782 | 9.8 | Feb 24 | Privilege escalation in the Netmonitor component Affected: before 140.8.0; before 148.0 |
The 500 most important CVEs for this product (exploited first, then by severity)
