PatchFirst · Latest vulnerabilities

thunderbird vulnerabilities · Page 19

Vulnerabilities published for thunderbird in the last 30 days: 278. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1344

CVE-2026-74969
High · CVSS 8.8EPSS 0.48%Fix available
Race condition, use-after-free in the Layout: Text and Fonts component
Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74967
Medium · CVSS 5.4EPSS 0.17%Fix available
Same-origin policy bypass in the Audio/Video: Playback component
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74965
High · CVSS 8.8EPSS 0.44%Fix available
Privilege escalation in the Shell Integration component
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74964
Critical · CVSS 9.8EPSS 0.68%Fix available
Integer overflow in the Graphics component
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74963
Medium · CVSS 5.4EPSS 0.17%Fix available
Same-origin policy bypass in the Networking: Cookies component
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74962
High · CVSS 8.1EPSS 0.22%Fix available
Site isolation issue in the Networking: Cookies component
Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74960
High · CVSS 8.1EPSS 0.22%Fix available
Site isolation issue in the WebExtensions component
Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74959
Critical · CVSS 9.1EPSS 0.48%Fix available
Mitigation bypass in the Storage: Cache API component
Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74957
High · CVSS 8.1EPSS 0.43%Fix available
Mitigation bypass in the Safe Browsing component
Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74953
High · CVSS 8.8EPSS 0.44%Fix available
Privilege escalation in the Networking: Cookies component
Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74949
High · CVSS 8.8EPSS 0.47%Fix available
Use-after-free in the Graphics: Canvas2D component
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74948
Medium · CVSS 6.5EPSS 0.44%Fix available
Information disclosure in the Graphics component
Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74946
High · CVSS 8.8EPSS 0.5%Fix available
Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74945
Medium · CVSS 6.5EPSS 0.44%Fix available
Information disclosure in the Graphics: Text component
Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74944
Critical · CVSS 9.8EPSS 0.59%Fix available
Use-after-free in the DOM: Core & HTML component
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74943
Critical · CVSS 9.8EPSS 0.61%Fix available
Use-after-free in the Graphics: ImageLib component
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74942
High · CVSS 8.8EPSS 0.45%Fix available
Privilege escalation in the Remote Settings Client component
Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74941
High · CVSS 8.8EPSS 0.48%Fix available
Privilege escalation in the Graphics: CanvasWebGL component
Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74940
Critical · CVSS 9.8EPSS 0.61%Fix available
Use-after-free in the Graphics: Text component
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74939
High · CVSS 8.8EPSS 0.45%Fix available
Privilege escalation in the DOM: Navigation component
Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
- Update to 1:140.14.0esr-1
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

thunderbird vulnerabilities · Page 19

Race condition, use-after-free in the Layout: Text and Fonts component

Same-origin policy bypass in the Audio/Video: Playback component

Privilege escalation in the Shell Integration component

Integer overflow in the Graphics component

Same-origin policy bypass in the Networking: Cookies component

Site isolation issue in the Networking: Cookies component

Site isolation issue in the WebExtensions component

Mitigation bypass in the Storage: Cache API component

Mitigation bypass in the Safe Browsing component

Privilege escalation in the Networking: Cookies component

Use-after-free in the Graphics: Canvas2D component

Information disclosure in the Graphics component

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Information disclosure in the Graphics: Text component

Use-after-free in the DOM: Core & HTML component

Use-after-free in the Graphics: ImageLib component

Privilege escalation in the Remote Settings Client component

Privilege escalation in the Graphics: CanvasWebGL component

Use-after-free in the Graphics: Text component

Privilege escalation in the DOM: Navigation component

Check your server