CVE Tools
Track your stack

Thunderbird

2,464 CVEs tracked. 14 of them are in CISA KEV.

This hub aggregates every CVE we track for Thunderbird, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.

Thunderbird CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Thunderbird CVEs per month
MonthCVEs
2024-120
2025-019
2025-0213
2025-0313
2025-0424
2025-0516
2025-0612
2025-0716
2025-087
2025-0910
2025-1011
2025-1116
2025-1213
2026-0117
2026-0251
2026-0347
2026-0450
2026-0537
2026-0642
2026-0766
2026-0855
2026-09185
2026-10262
2026-110

Severity

How the 2,464 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical77932%
  • High87335%
  • Medium78632%
  • Low261%

Latest CVEs

The 15 most recently published vulnerabilities affecting Thunderbird.

  1. CVE-2026-118180Matrix homeserver could redirect the chat session to a local file or network share7.5
  2. CVE-2026-118179Request forgery via news: links8.8
  3. CVE-2026-118177Calendar discovery accepted local file and remote network share locations9.1
  4. CVE-2026-118178RSS feed could redirect its subscription to a local file or network share5.7
  5. CVE-2026-118176Bypass of remote UNC path restriction in mailbox: URLs8.1
  6. CVE-2026-118175Content of other messages could be included when replying to a crafted message7.5
  7. CVE-2026-118174Displaying a message could load an attacker-chosen URL through an OpenPGP key attachment6.5
  8. CVE-2026-118024Use-after-free in the Graphics: Text component8.8
  9. CVE-2026-118025Other issue in the SVG component8.8
  10. CVE-2026-118026Invalid pointer in the JavaScript: GC component8.8
  11. CVE-2026-118022Sandbox escape due to use-after-free in the Disability Access APIs component8.8
  12. CVE-2026-118021Sandbox escape due to use-after-free in the XPCOM component8.8
  13. CVE-2026-118023Sandbox escape due to use-after-free in the Graphics: WebRender component8.8
  14. CVE-2026-118019Race condition, use-after-free in the DOM: File component8.8
  15. CVE-2026-118020Use-after-free in the Layout component8.8

Product grouping is registry-driven, with AI assist and human review. How it works