Skip to contentMozilla Thunderbird vulnerabilities
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11CVE-2025-5268Fix available8.1 High
- mozilla firefox, thunderbird +1 moreClickjacking vulnerability could have led to leaking saved payment card detailsCVE-2025-5267Fix available5.4 Medium
- mozilla firefox, thunderbird +1 moreScript element events leaked cross-origin resource statusCVE-2025-5266Fix available4.3 Medium
- mozilla firefox, thunderbird +1 morePotential local code execution in “Copy as cURL” commandCVE-2025-5265Fix available4.8 Medium
- mozilla firefox, thunderbird +1 morePotential local code execution in “Copy as cURL” commandCVE-2025-5264Fix available4.8 Medium
- mozilla firefox, thunderbird +1 moreError handling for script execution was incorrectly isolated from web contentCVE-2025-5263Fix available4.3 Medium
- mozilla thunderbirdA double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when...CVE-2025-52627.5 High
- mozilla firefox, thunderbird +1 moreOut-of-bounds access when optimizing linear sumsCVE-2025-4919Fix available8.8 High
- mozilla firefox, thunderbird +1 moreOut-of-bounds access when resolving Promise objectsCVE-2025-4918Fix available9.8 Critical
- mozilla thunderbirdTracking Links in Attachments Bypassed Remote Content BlockingCVE-2025-3932Fix available6.5 Medium
- mozilla thunderbirdJavaScript Execution via Spoofed PDF Attachment and file:/// LinkCVE-2025-3909Fix available8.1 High
- mozilla thunderbirdSender Spoofing via Malformed From Header in ThunderbirdCVE-2025-3875Fix available7.5 High
- mozilla firefox, thunderbird +1 moreMemory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10CVE-2025-4093Fix available8.1 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 138 and Thunderbird 138CVE-2025-4092Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10CVE-2025-4091Fix available8.1 High
- mozilla firefox, thunderbird +1 moreLeaked library paths in Thunderbird for AndroidCVE-2025-40905.3 Medium
- mozilla firefox, thunderbird +1 morePotential local code execution in "copy as cURL" commandCVE-2025-4089Fix available5.1 Medium
- mozilla firefox, thunderbird +1 moreCross-site request forgery via storage access API redirectsCVE-2025-4088Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreUnsafe attribute access during XPath parsingCVE-2025-4087Fix available4.8 Medium
- mozilla firefox, thunderbird +1 moreSpecially crafted filename could be used to obscure download typeCVE-2025-40866.5 Medium
- mozilla firefox, thunderbird +1 morePotential information leakage and privilege escalation in UITour actorCVE-2025-4085Fix available7.1 High
- mozilla firefox, thunderbird +1 morePotential local code execution in "copy as cURL" commandCVE-2025-40845.7 Medium
- mozilla firefox, thunderbird +1 moreProcess isolation bypass using "javascript:" URI links in cross-origin framesCVE-2025-4083Fix available9.1 Critical
- mozilla firefox, thunderbird +1 moreWebGL shader attribute memory corruption in Thunderbird for macOSCVE-2025-40825.9 Medium
- mozilla firefox, thunderbird +1 morePrivilege escalation in Thunderbird UpdaterCVE-2025-2817Fix available8.8 High
- mozilla thunderbirdUser Interface (UI) Misrepresentation of attachment URLCVE-2025-3523Fix available6.4 Medium
- mozilla thunderbirdLeak of hashed Window credentials via crafted attachment URLCVE-2025-3522Fix available6.3 Medium
- mozilla thunderbirdInformation Disclosure of /tmp directory listingCVE-2025-2830Fix available6.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 137 and Thunderbird 137CVE-2025-3034Fix available8.1 High
- mozilla firefox, thunderbird +1 moreOpening local .url files could lead to another file being openedCVE-2025-30337.7 High
- mozilla firefox, thunderbird +1 moreLeaking file descriptors from the fork serverCVE-2025-3032Fix available7.4 High
- mozilla firefox, thunderbird +1 moreJIT optimization bug with different stack slot sizesCVE-2025-3031Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9CVE-2025-3030Fix available8.1 High
- mozilla firefox, thunderbird +1 moreURL Bar Spoofing via non-BMP Unicode charactersCVE-2025-3029Fix available7.3 High
- mozilla firefox, thunderbird +1 moreUse-after-free triggered by XSLTProcessorCVE-2025-3028Fix available6.5 Medium
- mozilla thunderbirdCrafted email message incorrectly shown as being encryptedCVE-2025-26696Fix available7.0 High
- mozilla thunderbirdDownloading of OpenPGP keys from WKD used incorrect paddingCVE-2025-26695Fix available5.3 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 136 and Thunderbird 136CVE-2025-1943Fix available8.2 High
- mozilla firefox, thunderbird +1 moreDisclosure of uninitialized memory when .toUpperCase() causes string to get longerCVE-2025-1942Fix available9.8 Critical
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8CVE-2025-1938Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.8CVE-2025-1937Fix available7.5 High
- mozilla firefox, thunderbird +1 moreAdding %00 and a fake extension to a jar: URL changed the interpretation of the contentsCVE-2025-1936Fix available7.3 High
- mozilla firefox, thunderbird +1 moreClickjacking the registerProtocolHandler info-barCVE-2025-1935Fix available4.3 Medium
- mozilla firefox, thunderbird +1 moreUnexpected GC during RegExp bailout processingCVE-2025-1934Fix available6.5 Medium
- mozilla firefox, thunderbird +1 moreJIT corruption of WASM i32 return values on 64-bit CPUsCVE-2025-1933Fix available7.6 High
- mozilla firefox, thunderbird +1 moreInconsistent comparator in XSLT sorting led to out-of-bounds accessCVE-2025-1932Fix available8.1 High
- mozilla firefox, thunderbird +1 moreUse-after-free in WebTransportChildCVE-2025-1931Fix available7.5 High
- mozilla firefox, thunderbird +1 moreAudioIPC StreamData could trigger a use-after-free in the Browser processCVE-2025-1930Fix available8.8 High
- mozilla firefox, thunderbird +1 moreMemory safety bugs fixed in Firefox 135 and Thunderbird 135CVE-2025-1020Fix available9.8 Critical
- mozilla thunderbirdUnsanitized address book fieldsCVE-2025-1015Public exploitFix available5.4 Medium
- Show moreLoading…