Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-109742 | 4.3 medium | 0.00% | no CPE yet | Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-100766 | 4.3 medium | 0.00% | mozilla, firefox, thunderbird | Information disclosure in the Networking: JAR component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | 13 Oct |
| CVE-2026-109776 | 4.2 medium | 0.00% | no CPE yet | Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 15 Oct |
| CVE-2026-109779 | 4.2 medium | 0.00% | no CPE yet | Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 13 Oct |
| CVE-2026-109765 | 4.2 medium | 0.00% | no CPE yet | Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-109719 | 4.2 medium | 0.00% | no CPE yet | Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | 13 Oct |
| CVE-2026-113867 | unscored | 0.00% | no CPE yet | Thunderbird did not escape attribute values when serializing outgoing XMPP stanzas. Because values from incoming requests were echoed back in automatic replies, a remote XMPP user could send a crafted request that caused Thunderbird to inject arbitrary stanzas into the user's connection, which the server would then process as if sent by the user. This could be used to send messages or change contact and subscription settings on behalf of the user, without any interaction. This bug only affects Thunderbird's chat feature with XMPP accounts. This vulnerability was fixed in Thunderbird 158.0.1 and Thunderbird 153.5.1. | Thu 29 Oct |
| CVE-2026-113399 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | Thu 29 Oct |
| CVE-2026-74950 | unscored | 0.00% | mozilla, firefox, thunderbird | Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | Wed 28 Oct |
| CVE-2026-118174 | unscored | 0.00% | no CPE yet | When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118175 | unscored | 0.00% | no CPE yet | When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118176 | unscored | 0.00% | no CPE yet | Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118177 | unscored | 0.00% | no CPE yet | When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118178 | unscored | 0.00% | no CPE yet | A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118179 | unscored | 0.00% | no CPE yet | Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118180 | unscored | 0.00% | no CPE yet | When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6. | Wed 28 Oct |
| CVE-2026-118004 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the CSS Transitions and Animations component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118003 | unscored | 0.00% | no CPE yet | Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118002 | unscored | 0.00% | no CPE yet | Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-118000 | unscored | 0.00% | no CPE yet | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117999 | unscored | 0.00% | no CPE yet | Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117998 | unscored | 0.00% | no CPE yet | Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117997 | unscored | 0.00% | no CPE yet | Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117996 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117995 | unscored | 0.00% | no CPE yet | Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117994 | unscored | 0.00% | no CPE yet | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117993 | unscored | 0.00% | no CPE yet | Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117992 | unscored | 0.00% | no CPE yet | Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117991 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117990 | unscored | 0.00% | no CPE yet | Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117989 | unscored | 0.00% | no CPE yet | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117988 | unscored | 0.00% | no CPE yet | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117987 | unscored | 0.00% | no CPE yet | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117986 | unscored | 0.00% | no CPE yet | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117985 | unscored | 0.00% | no CPE yet | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117984 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the Layout: Scrolling and Overflow component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117983 | unscored | 0.00% | no CPE yet | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117982 | unscored | 0.00% | no CPE yet | Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117981 | unscored | 0.00% | no CPE yet | Privilege escalation in the Toolkit component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117980 | unscored | 0.00% | no CPE yet | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117979 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117978 | unscored | 0.00% | no CPE yet | Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117977 | unscored | 0.00% | no CPE yet | Other issue in the Console component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117976 | unscored | 0.00% | no CPE yet | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117975 | unscored | 0.00% | no CPE yet | Sandbox escape due to invalid pointer in the Graphics: WebRender component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117974 | unscored | 0.00% | no CPE yet | Use-after-free in the XML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117973 | unscored | 0.00% | no CPE yet | Use-after-free in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117972 | unscored | 0.00% | no CPE yet | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117971 | unscored | 0.00% | no CPE yet | Sandbox escape due to use-after-free in the Print Preview component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
| CVE-2026-117970 | unscored | 0.00% | no CPE yet | Race condition in the Disability Access APIs component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6. | Tue 27 Oct |
Download these 581 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.