Skip to content
OpenAdvisories

Package · Debian

thunderbird

1,346 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-109721 Public exploit

    Incorrect boundary conditions in the JavaScript Engine: JIT component

    Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-74945 Public exploit

    Information disclosure in the Graphics: Text component

    Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 4.3
    CVE-2026-15718 Public exploit

    Invalid pointer in the JavaScript: WebAssembly component

    We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-8388 Public exploit

    Incorrect boundary conditions in the JavaScript Engine: JIT component

    Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 6.5
    CVE-2026-6770 Public exploit

    Other issue in the Storage: IndexedDB component

    Other issue in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.3
    CVE-2026-6765 Public exploit

    Information disclosure in the Form Autofill component

    Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.

    Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu
  • Medium 5.4
    CVE-2025-1015 Public exploit

    Unsanitized address book fields

    The Thunderbird Address Book URI fields contained unsanitized links. This could be used by an attacker to create and export an address book containing a malicious payload in a field. For example, in the “Other” field of the Instant Messaging section. If anoth…

    Mozilla Thunderbird thunderbird thunderbird Debian Ubuntu
  • Medium 5.6
    CVE-2024-4367 Public exploit EPSS 71%

    PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

    A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm
  • Medium 6.5
    CVE-2024-0741 Public exploit

    An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable c…

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2023-1999 Public exploit

    Use after free in libwebp

    There exists a use after free/double free in libwebp. An attacker can use the ApplyFiltersAndEncode() function and loop through to free best.bw and assign best = trial pointer. The second loop will then return 0 because of an Out of memory error in VP8 encode…

    Chromium libwebp thunderbird mozjs38 Debian Ubuntu Alpine