Package · Ubuntu

thunderbird

1,853 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

Critical 9.8

CVE-2026-74943 Public exploit

Use-after-free in the Graphics: ImageLib component

Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Aug 18, 2026
Critical 9.8

CVE-2026-74936 Public exploit

Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Aug 18, 2026
Critical 9.6

CVE-2026-12295 Public exploit

Sandbox escape in the DOM: Navigation component

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Jun 16, 2026
Critical 9.6

CVE-2026-4692 Public exploit

Sandbox escape in the Responsive Design Mode component

Sandbox escape in the Responsive Design Mode component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Mar 24, 2026
Critical 9.8

CVE-2026-2796 Public exploit

JIT miscompilation in the JavaScript: WebAssembly component

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Mozilla Firefox Thunderbird thunderbird Browsers Ubuntu Wolfi

Feb 24, 2026
Critical 9.8

CVE-2026-2766 Public exploit

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Feb 24, 2026
Critical 9.8

CVE-2026-2764 Public exploit

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component

JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Feb 24, 2026
Critical 9.8

CVE-2026-2763 Public exploit

Use-after-free in the JavaScript Engine component

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Feb 24, 2026
Critical 9.8

CVE-2025-14321 Public exploit

Use-after-free in the WebRTC: Signaling component

Use-after-free in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu Wolfi

Dec 9, 2025
Critical 9.8

CVE-2024-9680 Exploited · Ransomware Public exploit EPSS 23%

An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timel…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine Wolfi

Oct 9, 2024
KEV Oct 15, 2024
Critical 9.8

CVE-2024-8381 Public exploit

A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as …

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Wolfi

Sep 3, 2024
Critical 9.8

CVE-2022-25315 Public exploit

In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 18, 2022
Critical 9.8

CVE-2022-25235 Public exploit

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a U…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-25236 Public exploit EPSS 35%

xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespac…

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Feb 16, 2022
Critical 9.8

CVE-2022-23852 Public exploit

Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML…

thunderbird firefox qt5-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine

Jan 24, 2022
Critical 9.8

CVE-2022-22822 Public exploit

addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.

thunderbird firefox insighttoolkit4 expat Debian Ubuntu Azure Linux Alpine

Jan 8, 2022
Critical 10.0

CVE-2019-11708 Exploited Public exploit EPSS 56%

Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can resul…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 23, 2019
KEV May 23, 2022