CVE Tools
Track your stack

Thunderbird

2,567 CVEs tracked. 14 of them are in CISA KEV.

This hub aggregates every CVE we track for Thunderbird, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.

Thunderbird CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Thunderbird CVEs per month
MonthCVEs
2024-120
2025-019
2025-0213
2025-0313
2025-0424
2025-0516
2025-0612
2025-0716
2025-087
2025-0910
2025-1011
2025-1116
2025-1213
2026-0117
2026-0251
2026-0347
2026-0450
2026-0537
2026-0642
2026-0766
2026-0855
2026-09185
2026-10262
2026-11103

Severity

How the 2,567 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical78631%
  • High92537%
  • Medium79231%
  • Low261%

Latest CVEs

The 15 most recently published vulnerabilities affecting Thunderbird.

  1. CVE-2026-126136OAuth2 access token could be sent over an unencrypted connection with Exchange accounts—
  2. CVE-2026-126135SMTP and POP3 response injection when using STARTTLS—
  3. CVE-2026-126134Feed subscriptions could leak NTLM credentials on Windows—
  4. CVE-2026-126133Calendar server credentials could be sent to an HTTP proxy—
  5. CVE-2026-126132Attachments could be replaced with local file content when forwarding—
  6. CVE-2026-124950Same-origin policy bypass in the CSS Parsing and Computation component—
  7. CVE-2026-124949Other issue in the SVG component—
  8. CVE-2026-124947Incorrect boundary conditions in the Graphics component8.8
  9. CVE-2026-124945Invalid pointer in the Layout: Text and Fonts component—
  10. CVE-2026-124946Invalid pointer in the JavaScript Engine: JIT component—
  11. CVE-2026-124943Use-after-free in the Layout component8.8
  12. CVE-2026-124944Information disclosure in the Marionette component4.3
  13. CVE-2026-124936Spoofing issue in the Address Bar component—
  14. CVE-2026-124928Mitigation bypass in the SVG component—
  15. CVE-2026-124925Information disclosure in the Layout component4.3

Product grouping is registry-driven, with AI assist and human review. How it works