PatchFirst · Latest vulnerabilities

thunderbird vulnerabilities · Page 25

Vulnerabilities published for thunderbird in the last 30 days: 263. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 1304

CVE-2026-74987
Critical · CVSS 9.8EPSS 0.71%No fix published
Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154
Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74983
High · CVSS 8.1EPSS 0.43%No fix published
Mitigation bypass in the Data Loss Prevention component
Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated September 17, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74976
Medium · CVSS 6.5EPSS 0.42%No fix published
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74974
Medium · CVSS 5.4EPSS 0.17%No fix published
Same-origin policy bypass in the Graphics: ImageLib component
Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74973
Medium · CVSS 4.2EPSS 0.21%No fix published
Race condition, use-after-free in the Graphics component
Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74972
Medium · CVSS 4.3EPSS 0.35%No fix published
Information disclosure in the DOM: Push Subscriptions component
Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74971
Medium · CVSS 4.3EPSS 0.35%No fix published
Information disclosure in the DOM: UI Events & Focus Handling component
Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74969
High · CVSS 8.8EPSS 0.48%No fix published
Race condition, use-after-free in the Layout: Text and Fonts component
Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74967
Medium · CVSS 5.4EPSS 0.17%No fix published
Same-origin policy bypass in the Audio/Video: Playback component
Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74965
High · CVSS 8.8EPSS 0.44%No fix published
Privilege escalation in the Shell Integration component
Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74964
Critical · CVSS 9.8EPSS 0.68%No fix published
Integer overflow in the Graphics component
Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74963
Medium · CVSS 5.4EPSS 0.17%No fix published
Same-origin policy bypass in the Networking: Cookies component
Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 18, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74962
High · CVSS 8.1EPSS 0.22%No fix published
Site isolation issue in the Networking: Cookies component
Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 19, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74960
High · CVSS 8.1EPSS 0.22%No fix published
Site isolation issue in the WebExtensions component
Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74959
Critical · CVSS 9.1EPSS 0.48%No fix published
Mitigation bypass in the Storage: Cache API component
Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74957
High · CVSS 8.1EPSS 0.43%No fix published
Mitigation bypass in the Safe Browsing component
Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74953
High · CVSS 8.8EPSS 0.44%No fix published
Privilege escalation in the Networking: Cookies component
Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74949
High · CVSS 8.8EPSS 0.47%No fix published
Use-after-free in the Graphics: Canvas2D component
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74948
Medium · CVSS 6.5EPSS 0.44%No fix published
Information disclosure in the Graphics component
Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated August 21, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2026-74946
High · CVSS 8.8EPSS 0.5%No fix published
Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component
Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
thunderbird Operating systems
Published August 18, 2026Updated October 28, 2026
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

thunderbird vulnerabilities · Page 25

Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154

Mitigation bypass in the Data Loss Prevention component

JIT miscompilation in the JavaScript Engine: JIT component

Same-origin policy bypass in the Graphics: ImageLib component

Race condition, use-after-free in the Graphics component

Information disclosure in the DOM: Push Subscriptions component

Information disclosure in the DOM: UI Events & Focus Handling component

Race condition, use-after-free in the Layout: Text and Fonts component

Same-origin policy bypass in the Audio/Video: Playback component

Privilege escalation in the Shell Integration component

Integer overflow in the Graphics component

Same-origin policy bypass in the Networking: Cookies component

Site isolation issue in the Networking: Cookies component

Site isolation issue in the WebExtensions component

Mitigation bypass in the Storage: Cache API component

Mitigation bypass in the Safe Browsing component

Privilege escalation in the Networking: Cookies component

Use-after-free in the Graphics: Canvas2D component

Information disclosure in the Graphics component

Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Check your server