Thunderbird

Source repositories

https://github.com/mozilla/releases-comm-central

CVEs (2,164)

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-100789	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100785	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100784	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100782	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100780	Mozilla Corporation Thunderbird	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100779	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100777	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100776	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100774	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100773	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100772	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100769	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100768	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100767	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100765	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100764	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100761	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100757	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 29, 2026	Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-92076	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 15, 2026	Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92074	Mozilla Corporation Firefox	Hig	0.57	8.8	Sep 15, 2026	Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

CVE-2026-100789HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100785HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100784HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100782HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100780HigSep 29, 2026
Mozilla Corporation
Thunderbird
risk 0.57cvss 8.8epss 0.00
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100779HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100777HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100776HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100774HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100773HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100772HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100769HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100768HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100767HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Networking: Cache component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-100765HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157.
CVE-2026-100764HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100761HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157.
CVE-2026-100757HigSep 29, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17.
CVE-2026-92076HigSep 15, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVE-2026-92074HigSep 15, 2026
Mozilla Corporation
Firefox
risk 0.57cvss 8.8epss 0.00
Mitigation bypass in the Popup Blocker component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.

Page 24 of 109