CVE Tools
Track your stack

Thunderbird

2,292 CVEs tracked. 14 of them are in CISA KEV.

This hub aggregates every CVE we track for Thunderbird, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.

Thunderbird CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Thunderbird CVEs per month
MonthCVEs
2024-1117
2024-120
2025-019
2025-0213
2025-0313
2025-0424
2025-0516
2025-0612
2025-0716
2025-087
2025-0910
2025-1011
2025-1116
2025-1213
2026-0117
2026-0251
2026-0347
2026-0450
2026-0537
2026-0642
2026-0766
2026-0855
2026-09185
2026-1090

Severity

How the 2,292 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical75733%
  • High75833%
  • Medium74333%
  • Low261%

Latest CVEs

The 15 most recently published vulnerabilities affecting Thunderbird.

  1. CVE-2026-113869Use-after-free in S/MIME decryption during a security device password prompt5.4
  2. CVE-2026-113868Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication5.3
  3. CVE-2026-113867Stanza injection in XMPP chat—
  4. CVE-2026-113866Account password sent unencrypted during Exchange account setup5.9
  5. CVE-2026-113401Denial-of-service in the PDF Viewer component6.5
  6. CVE-2026-113400Uninitialized memory in the Audio/Video: cubeb component5.4
  7. CVE-2026-113399Incorrect boundary conditions in the SVG component—
  8. CVE-2026-113470Cryptographic issue in the Security Block-lists, Allow-lists, and other State component5.4
  9. CVE-2026-110249Denial-of-service in the Exchange email component8.6
  10. CVE-2026-110247Integer overflow in libmime buffer growth could lead to heap corruption8.4
  11. CVE-2026-109782Mitigation bypass in the File Handling component—
  12. CVE-2026-109783Mitigation bypass in the File Handling component—
  13. CVE-2026-109779Race condition in the Networking: DNS component4.2
  14. CVE-2026-109780Mitigation bypass in the DOM: Core & HTML component—
  15. CVE-2026-109781Denial-of-service in the Printing: Output component6.5

Product grouping is registry-driven, with AI assist and human review. How it works