Thunderbird at a glance
1 of the exploited vulnerabilities are known to be used by ransomware (CISA).
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 103 | 7 |
| Oct 2026 | 262 | 30 |
| Sep 2026 | 185 | 55 |
| Aug 2026 | 55 | 17 |
| Jul 2026 | 66 | 39 |
| Jun 2026 | 42 | 8 |
| May 2026 | 37 | 8 |
| Apr 2026 | 50 | 6 |
| Mar 2026 | 47 | 22 |
| Feb 2026 | 51 | 28 |
| Jan 2026 | 17 | 4 |
| Dec 2025 | 13 | 4 |
| Nov 2025 | 15 | 5 |
| Oct 2025 | 11 | 5 |
| Sep 2025 | 10 | 0 |
| Aug 2025 | 7 | 2 |
| Jul 2025 | 15 | 5 |
| Jun 2025 | 12 | 3 |
| May 2025 | 16 | 1 |
| Apr 2025 | 23 | 1 |
| Mar 2025 | 13 | 1 |
| Feb 2025 | 13 | 7 |
| Jan 2025 | 8 | 1 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Latest advisories
-
High max 9.8
Mozilla Firefox, Firefox ESR, und Thunderbird: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Mozilla Firefox ESR und Mozilla Thunderbird ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren u…
first Oct 27, 2026 -
High max 9.8
Mozilla Firefox, Firefox ESR und Thunderbird: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox ESR, Mozilla Firefox und Thunderbird ausnutzen, um beliebigen Programmcode auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, einen D…
first Sep 29, 2026 -
High max 9.8
Mozilla Produkte (Thunderbird, Firefox ESR und Firefox): Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Thunderbird, Mozilla Firefox ESR und Mozilla Firefox ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen und um Daten zu manipul…
first Oct 20, 2026 -
High max 9.8
Mozilla Firefox und Thunderbrid: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox und Mozilla Thunderbrid ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Spoofing-Angriffe durchzuführen, Daten offenzulegen oder zu manipulieren, Denial-of-Service-Zustä…
first Oct 13, 2026 -
High max 9.8
Mozilla Firefox und Thunderbird: Mehrere Schwachstellen
Ein Angreifer kann mehrere Schwachstellen in Mozilla Firefox, Firefox ESR und Thunderbird ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren, den Speicher zu beschädigen, Denial-of-Service-Zust…
first Sep 15, 2026
1,814 results · Feed
-
Unscored —
OAuth2 access token could be sent over an unencrypted connection with Exchange accounts
For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token…
-
Unscored —
SMTP and POP3 response injection when using STARTTLS
If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as…
-
Unscored —
Feed subscriptions could leak NTLM credentials on Windows
Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to t…
-
Unscored —
Calendar server credentials could be sent to an HTTP proxy
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, w…
-
Unscored —
Attachments could be replaced with local file content when forwarding
When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it point…
-
Unscored —
Same-origin policy bypass in the CSS Parsing and Computation component
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Other issue in the SVG component
Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Invalid pointer in the Layout: Text and Fonts component
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Invalid pointer in the JavaScript Engine: JIT component
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the Layout component
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Medium 4.3
Information disclosure in the Marionette component
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Mitigation bypass in the SVG component
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Spoofing issue in the Address Bar component
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Sandbox escape in the Agent component
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Medium 4.3
Information disclosure in the Layout component
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Uninitialized memory in the Graphics: WebGPU component
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Unscored —
Sandbox escape in the Graphics: WebGPU component
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the CSS Parsing and Computation component
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the SVG component
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the Layout: Positioned component
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
Critical 9.6
Sandbox escape due to use-after-free in the DOM: Service Workers component
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the DOM: Editor component
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Use-after-free in the DOM: HTML Parser component
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions in the Graphics: CanvasWebGL component
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
-
High 8.8
Incorrect boundary conditions, use-after-free in the Graphics component
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Privilege escalation in the Nimbus Desktop Client component
Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Security: RLBox component
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Invalid pointer in the DOM: Streams component
Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
JIT miscompilation in the JavaScript Engine: JIT component
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Mitigation bypass in the File Handling component
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Undefined behavior in the WebRTC: Networking component
Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Mitigation bypass in the Add-ons Manager component
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Spoofing issue in the Security component
Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Use-after-free in the Graphics component
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Sandbox escape in the Console component
Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Unscored —
Same-origin policy bypass in the DOM: Core & HTML component
Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Layout: Form Controls component
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
Medium 4.3
Information disclosure in the Address Bar component
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
-
High 8.8
Incorrect boundary conditions in the WebRTC component
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.