Total
2070 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-100794 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | N/A | 9.6 CRITICAL |
| Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17. | |||||
| CVE-2026-100795 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | N/A | 6.5 MEDIUM |
| Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |||||
| CVE-2026-100796 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | N/A | 8.8 HIGH |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | |||||
| CVE-2026-100797 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | N/A | 8.8 HIGH |
| Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | |||||
| CVE-2025-10531 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-18 | N/A | 5.4 MEDIUM |
| Mitigation bypass in the Web Compatibility: Tooling component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. | |||||
| CVE-2025-10530 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-18 | N/A | 6.5 MEDIUM |
| Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143. | |||||
| CVE-2025-10534 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-18 | N/A | 8.1 HIGH |
| Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. | |||||
| CVE-2025-11721 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-18 | N/A | 9.8 CRITICAL |
| Memory safety bug present in Firefox 143 and Thunderbird 143. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 144 and Thunderbird 144. | |||||
| CVE-2025-11716 | 2 Google, Mozilla | 3 Android, Firefox, Thunderbird | 2026-10-18 | N/A | 6.5 MEDIUM |
| Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability was fixed in Firefox 144 and Thunderbird 144. | |||||
| CVE-2025-11719 | 2 Microsoft, Mozilla | 3 Windows, Firefox, Thunderbird | 2026-10-18 | N/A | 9.8 CRITICAL |
| Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability was fixed in Firefox 144 and Thunderbird 144. | |||||
| CVE-2026-103500 | 1 Mozilla | 1 Thunderbird | 2026-10-16 | N/A | 6.1 MEDIUM |
| An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size. This vulnerability was fixed in Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4. | |||||
| CVE-2017-5436 | 4 Debian, Mozilla, Redhat and 1 more | 10 Debian Linux, Firefox, Thunderbird and 7 more | 2026-10-16 | 6.8 MEDIUM | 8.8 HIGH |
| An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53. | |||||
| CVE-2026-8950 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 9.3 CRITICAL |
| Same-origin policy bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8956 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 9.8 CRITICAL |
| Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8946 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 7.5 HIGH |
| Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8955 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 8.8 HIGH |
| Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8958 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 8.6 HIGH |
| Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8957 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 8.8 HIGH |
| Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8959 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 9.6 CRITICAL |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11. | |||||
| CVE-2026-8948 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-14 | N/A | 9.1 CRITICAL |
| Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151 and Thunderbird 151. | |||||