PatchFirst · Latest vulnerabilities

thunderbird vulnerabilities · Page 9

Vulnerabilities published for thunderbird in the last 30 days: 107. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1152

CVE-2026-74967
Medium · CVSS 5.4EPSS 0.17%Fix available
Same-origin policy bypass in the Audio/Video: Playback component
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74965
High · CVSS 8.8EPSS 0.44%Fix available
Privilege escalation in the Shell Integration component
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74964
Critical · CVSS 9.8EPSS 0.68%Fix available
Integer overflow in the Graphics component
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74963
Medium · CVSS 5.4EPSS 0.17%Fix available
Same-origin policy bypass in the Networking: Cookies component
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74962
High · CVSS 8.1EPSS 0.22%Fix available
Site isolation issue in the Networking: Cookies component
Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74960
High · CVSS 8.1EPSS 0.22%Fix available
Site isolation issue in the WebExtensions component
Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74959
Critical · CVSS 9.1EPSS 0.48%Fix available
Mitigation bypass in the Storage: Cache API component
Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74957
High · CVSS 8.1EPSS 0.43%Fix available
Mitigation bypass in the Safe Browsing component
Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74953
High · CVSS 8.8EPSS 0.44%Fix available
Privilege escalation in the Networking: Cookies component
Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74949
High · CVSS 8.8EPSS 0.47%Fix available
Privilege escalation due to use-after-free in the Graphics: Canvas2D component
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated September 1, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74948
Medium · CVSS 6.5EPSS 0.44%Fix available
Information disclosure in the Graphics component
Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74946
High · CVSS 8.8EPSS 0.49%Fix available
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74945
Medium · CVSS 6.5EPSS 0.44%Fix available
Information disclosure in the Graphics: Text component
Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74944
Critical · CVSS 9.8EPSS 0.59%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74943
Critical · CVSS 9.8EPSS 0.61%Fix available
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74942
High · CVSS 8.8EPSS 0.45%Fix available
Privilege escalation in the Remote Settings Client component
Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74941
High · CVSS 8.8EPSS 0.48%Fix available
Privilege escalation in the Graphics: CanvasWebGL component
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74940
Critical · CVSS 9.8EPSS 0.61%Fix available
Use-after-free in the Graphics: Text component
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74939
High · CVSS 8.8EPSS 0.45%Fix available
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74936
Critical · CVSS 9.8EPSS 0.59%Fix available
Use-after-free in the JavaScript: WebAssembly component
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1~deb13u1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

thunderbird vulnerabilities · Page 9

Same-origin policy bypass in the Audio/Video: Playback component

Privilege escalation in the Shell Integration component

Integer overflow in the Graphics component

Same-origin policy bypass in the Networking: Cookies component

Site isolation issue in the Networking: Cookies component

Site isolation issue in the WebExtensions component

Mitigation bypass in the Storage: Cache API component

Mitigation bypass in the Safe Browsing component

Privilege escalation in the Networking: Cookies component

Privilege escalation due to use-after-free in the Graphics: Canvas2D component

Information disclosure in the Graphics component

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Information disclosure in the Graphics: Text component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the Graphics: ImageLib component

Privilege escalation in the Remote Settings Client component

Privilege escalation in the Graphics: CanvasWebGL component

Use-after-free in the Graphics: Text component

Privilege escalation in the DOM: Navigation component

Use-after-free in the JavaScript: WebAssembly component

Check your server