Product · Mozilla

Thunderbird

1,814 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

High 8.1

CVE-2026-109722 Public exploit

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Oct 13, 2026
High 8.1

CVE-2026-109715 Public exploit

Incorrect boundary conditions in the JavaScript Engine component

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Oct 13, 2026
High 8.8

CVE-2026-74939 Public exploit

Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Aug 18, 2026
High 7.3

CVE-2025-14325 Public exploit

JIT miscompilation in the JavaScript Engine: JIT component

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6.

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Dec 9, 2025
High 8.8

CVE-2022-28281 Public exploit

If a compromised content process sent an unexpected number of WebAuthN Extensions in a Register command to the parent p…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 8.8

CVE-2022-1802 Public exploit EPSS 28%

If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could hav…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
High 8.8

CVE-2022-26485 Exploited Public exploit EPSS 14%

Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of a…

Mozilla Firefox Thunderbird Firefox ESR Android Browsers Debian Ubuntu Alpine

Dec 22, 2022
KEV Mar 7, 2022
High 8.8

CVE-2019-17026 Exploited Public exploit EPSS 46%

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Mar 2, 2020
KEV Nov 3, 2021
High 8.8

CVE-2019-11707 Exploited Public exploit EPSS 38%

A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allo…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu Alpine

Jul 23, 2019
KEV May 23, 2022
High 7.5

CVE-2016-9079 Exploited Public exploit EPSS 87%

A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been di…

Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu

Jun 11, 2018
KEV Jun 22, 2023