WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product thunderbird✕
Overview 2,069 matches · 0 in Waratek scope · 0 protected · 26 exploited · 14 CISA KEV · 65 public PoC · 18 EPSS ≥ 0.5
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 6 0.3% Not applicable 2,063 99.7% Withdrawn CVE 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2,069 100.0% not established 0 0.0% unrecorded 0 0.0%
split by peak 503 / year
Not applicable: 2,063Outside Waratek scope: 6 Low: 26Medium: 646High: 1,009Critical: 388 not blocked: 2,069 No public exploit: 1,937Forecast only: 2Proof of concept only: 60Working exploit published: 44Exploited: 26
200413 Not applicable13 High5 Medium7 Low1 not blocked13 Working exploit published1 No public exploit12 200513 Not applicable13 High3 Medium6 Low4 not blocked13 Working exploit published1 No public exploit12 200669 Not applicable69 High32 Medium29 Low8 not blocked69 Working exploit published4 No public exploit65 200716 Not applicable16 High9 Medium6 Low1 not blocked16 Working exploit published2 Forecast only1 No public exploit13 200850 Not applicable50 High27 Medium22 Low1 not blocked50 Working exploit published1 No public exploit49 200939 Not applicable39 High23 Medium16 not blocked39 Exploited1 Working exploit published2 No public exploit36 201063 Not applicable63 Critical2 High38 Medium23 not blocked63 Exploited1 Working exploit published6 No public exploit56 201169 Not applicable69 High48 Medium19 Low2 not blocked69 Working exploit published2 No public exploit67 2012149 Not applicable149 High99 Medium48 Low2 not blocked149 Working exploit published2 No public exploit147 2013113 Outside Waratek scope1 Not applicable112 Critical6 High75 Medium32 not blocked113 Exploited4 Working exploit published3 Forecast only1 No public exploit105 201464 Outside Waratek scope2 Not applicable62 Critical9 High33 Medium21 Low1 not blocked64 Exploited2 Working exploit published2 No public exploit60 201530 Outside Waratek scope1 Not applicable29 High16 Medium13 Low1 not blocked30 Working exploit published1 Proof of concept only1 No public exploit28 201613 Not applicable13 High11 Medium2 not blocked13 Working exploit published1 No public exploit12 20171 Not applicable1 High1 not blocked1 No public exploit1 2018176 Not applicable176 Critical86 High52 Medium38 not blocked176 Exploited1 Working exploit published6 Proof of concept only1 No public exploit168 201965 Not applicable65 Critical29 High20 Medium15 Low1 not blocked65 Exploited3 Working exploit published8 Proof of concept only1 No public exploit53 202081 Not applicable81 Critical5 High43 Medium33 not blocked81 Exploited4 Working exploit published1 No public exploit76 202180 Not applicable80 Critical1 High42 Medium36 Low1 not blocked80 No public exploit80 2022116 Not applicable116 Critical13 High48 Medium55 not blocked116 Exploited7 Proof of concept only32 No public exploit77 2023102 Outside Waratek scope1 Not applicable101 Critical8 High44 Medium49 Low1 not blocked102 Exploited2 Proof of concept only22 No public exploit78 2024118 Outside Waratek scope1 Not applicable117 Critical19 High51 Medium46 Low2 not blocked118 Exploited1 Working exploit published1 Proof of concept only1 No public exploit115 2025126 Not applicable126 Critical28 High57 Medium41 not blocked126 Proof of concept only1 No public exploit125 2026503 Not applicable503 Critical182 High232 Medium89 not blocked503 Proof of concept only1 No public exploit502
200420062008201020122014201620182020202220242026
2,069 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 21 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-74974 Medium 2026-08-18 Not applicable No public exploit Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74973 Medium 2026-08-18 Not applicable No public exploit Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74972 Medium 2026-08-18 Not applicable No public exploit Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74971 Medium 2026-08-18 Not applicable No public exploit Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74970 Medium 2026-08-18 Not applicable No public exploit Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74969 High 2026-08-18 Not applicable No public exploit Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74968 Medium 2026-08-18 Not applicable No public exploit Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74967 Medium 2026-08-18 Not applicable No public exploit Same-origin policy bypass in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74966 High 2026-08-18 Not applicable No public exploit Information disclosure in the Form Autofill component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74965 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74964 Critical 2026-08-18 Not applicable No public exploit Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74963 Medium 2026-08-18 Not applicable No public exploit Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74962 High 2026-08-18 Not applicable No public exploit Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74961 Critical 2026-08-18 Not applicable No public exploit Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74960 High 2026-08-18 Not applicable No public exploit Site isolation issue in the WebExtensions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74959 Critical 2026-08-18 Not applicable No public exploit Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74958 High 2026-08-18 Not applicable No public exploit Information disclosure in the WebRTC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74957 High 2026-08-18 Not applicable No public exploit Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74956 Critical 2026-08-18 Not applicable No public exploit Same-origin policy bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74955 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74954 High 2026-08-18 Not applicable No public exploit Information disclosure due to side-channel in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74953 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74952 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154, Thunderbird 154, Firefox ESR 153.2, and Thunderbird 153.2.
CVE-2026-74950 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74949 High 2026-08-18 Not applicable No public exploit Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74948 Medium 2026-08-18 Not applicable No public exploit Information disclosure in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74947 High 2026-08-18 Not applicable No public exploit Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74946 High 2026-08-18 Not applicable No public exploit Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74945 Medium 2026-08-18 Not applicable No public exploit Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74944 Critical 2026-08-18 Not applicable No public exploit Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74943 Critical 2026-08-18 Not applicable No public exploit Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74942 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74941 High 2026-08-18 Not applicable No public exploit Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74940 Critical 2026-08-18 Not applicable No public exploit Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74939 High 2026-08-18 Not applicable No public exploit Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74938 Critical 2026-08-18 Not applicable No public exploit Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74937 High 2026-08-18 Not applicable No public exploit Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1.
CVE-2026-74936 Critical 2026-08-18 Not applicable No public exploit Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74935 High 2026-08-18 Not applicable No public exploit Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-74934 High 2026-08-18 Not applicable No public exploit Site isolation issue in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1.
CVE-2026-14899 High 2026-07-22 Not applicable No public exploit The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.
CVE-2026-16410 Critical 2026-07-21 Not applicable No public exploit JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16409 High 2026-07-21 Not applicable No public exploit Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16407 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16403 Medium 2026-07-21 Not applicable No public exploit Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16402 Critical 2026-07-21 Not applicable No public exploit Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16401 High 2026-07-21 Not applicable No public exploit Privilege escalation in the Data Loss Prevention component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16400 High 2026-07-21 Not applicable No public exploit Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16399 High 2026-07-21 Not applicable No public exploit Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16398 High 2026-07-21 Not applicable No public exploit Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16396 High 2026-07-21 Not applicable No public exploit Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16393 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16392 Critical 2026-07-21 Not applicable No public exploit JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16391 High 2026-07-21 Not applicable No public exploit Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16390 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16389 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16388 Critical 2026-07-21 Not applicable No public exploit Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16387 Critical 2026-07-21 Not applicable No public exploit Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16386 High 2026-07-21 Not applicable No public exploit Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16385 High 2026-07-21 Not applicable No public exploit Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16384 High 2026-07-21 Not applicable No public exploit Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16383 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16382 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16381 Critical 2026-07-21 Not applicable No public exploit Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16380 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16379 High 2026-07-21 Not applicable No public exploit Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16378 High 2026-07-21 Not applicable No public exploit Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16377 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16376 High 2026-07-21 Not applicable No public exploit Denial-of-service in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16375 Critical 2026-07-21 Not applicable No public exploit Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16374 High 2026-07-21 Not applicable No public exploit Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16372 High 2026-07-21 Not applicable No public exploit Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16371 High 2026-07-21 Not applicable No public exploit Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16370 Critical 2026-07-21 Not applicable No public exploit Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16369 Critical 2026-07-21 Not applicable No public exploit Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16368 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16367 Critical 2026-07-21 Not applicable No public exploit Sandbox escape due to invalid pointer in the Disability Access APIs component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16366 High 2026-07-21 Not applicable No public exploit Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16365 High 2026-07-21 Not applicable No public exploit Privilege escalation in the DOM: Workers component. This vulnerability was fixed in Firefox 153, Thunderbird 153, Firefox ESR 140.15, and Thunderbird 140.15.
CVE-2026-16364 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16363 Critical 2026-07-21 Not applicable No public exploit JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16362 High 2026-07-21 Not applicable No public exploit Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16361 Critical 2026-07-21 Not applicable No public exploit Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
CVE-2026-16360 Critical 2026-07-21 Not applicable No public exploit Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16359 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16358 Critical 2026-07-21 Not applicable No public exploit Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16357 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16356 Critical 2026-07-21 Not applicable No public exploit Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16355 Critical 2026-07-21 Not applicable No public exploit JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16354 High 2026-07-21 Not applicable No public exploit Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16353 Critical 2026-07-21 Not applicable No public exploit Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16352 Critical 2026-07-21 Not applicable No public exploit Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16351 Critical 2026-07-21 Not applicable No public exploit Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16350 Critical 2026-07-21 Not applicable No public exploit Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-16349 Critical 2026-07-21 Not applicable No public exploit Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.
CVE-2026-57963 Medium 2026-07-01 Not applicable No public exploit An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
CVE-2026-57962 Medium 2026-07-01 Not applicable No public exploit A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and Thunderbird 140.12.1.
CVE-2026-12330 Medium 2026-06-16 Not applicable No public exploit Incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 140.12, Firefox ESR 115.37, and Thunderbird 140.12.
CVE-2026-12329 High 2026-06-16 Not applicable No public exploit Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.
CVE-2026-12328 High 2026-06-16 Not applicable No public exploit Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.
‹ prev page 3 of 21 next ›