TH
Product
Thunderbird
On CISA KEVExploited in the wildRansomware-linked
2,073
CVEs
14
On KEV
10.0
Max CVSS
77
New 30D
Severity mix
Critical 379High 120Medium 1Low 0
Watch
Add Thunderbird to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-16401 | 8.8 | Jul 21 | Privilege escalation in the Data Loss Prevention component Affected: before 153.0 |
| CVE-2026-16396 | 8.8 | Jul 21 | Privilege escalation in WebExtensions Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16379 | 8.8 | Jul 21 | Privilege escalation in the DOM: Content Processes component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16372 | 8.8 | Jul 21 | Privilege escalation in the DOM: Content Processes component Affected: before 153.0 |
| CVE-2026-16371 | 8.8 | Jul 21 | Privilege escalation in the DOM: Navigation component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-16366 | 8.8 | Jul 21 | Privilege escalation in the DOM: Navigation component Affected: before 153.0 |
| CVE-2026-16365 | 8.8 | Jul 21 | Privilege escalation in the DOM: Workers component Affected: before 153.0 |
| CVE-2026-16362 | 8.8 | Jul 21 | Use-after-free in the WebRTC: Audio/Video component Affected: before 140.13.0; 141.0 before 153.0 |
| CVE-2026-12291 | 8.8 | Jun 16 | Use-after-free in the Networking: HTTP component Affected: before 140.12.0; before 152.0.0 |
| CVE-2026-12289 | 8.8 | Jun 16 | Privilege escalation in the Graphics: WebRender component Affected: before 152.0.0; 140.0 before 140.12.0 |
| CVE-2026-8975 | 8.8 | May 19 | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 Affected: before 140.11; before 151.0.0 |
| CVE-2026-8974 | 8.8 | May 19 | Memory safety bugs fixed in Thunderbird 140.11 and Thunderbird 151 Affected: before 140.11; before 151.0.0 |
| CVE-2026-8973 | 8.8 | May 19 | Memory safety bugs fixed in Thunderbird 151 Affected: before 151.0.0 |
| CVE-2026-8972 | 8.8 | May 19 | Privilege escalation in the WebRTC: Audio/Video component Affected: before 151.0.0 |
| CVE-2026-8970 | 8.8 | May 19 | Privilege escalation in the Security component Affected: before 140.11; before 151.0.0 |
| CVE-2026-8957 | 8.8 | May 19 | Privilege escalation in the Enterprise Policies component Affected: before 140.11; before 151.0.0 |
| CVE-2026-8955 | 8.8 | May 19 | Privilege escalation in the DOM: Workers component Affected: before 140.11; before 151.0.0 |
| CVE-2026-8952 | 8.8 | May 19 | Privilege escalation in the Application Update component Affected: before 151.0.0 |
| CVE-2026-6769 | 8.8 | Apr 21 | Privilege escalation in the Debugger component Affected: before 140.10.0 |
| CVE-2026-6761 | 8.8 | Apr 21 | Privilege escalation in the Networking component Affected: before 140.10.0 |
The 500 most important CVEs for this product (exploited first, then by severity)