Thunderbird

Source repositories

https://github.com/mozilla/releases-comm-central

CVEs (1,864)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-4727	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4726	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4719	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4714	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4713	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4712	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4709	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4708	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4707	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4706	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4704	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4699	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4697	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4695	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4694	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4693	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4686	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4685	Mozilla Corporation Firefox	Hig	0.49	7.5	0.01	Mar 24, 2026	Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4684	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Mar 24, 2026	Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-2803	Mozilla Corporation Firefox	Hig	0.49	7.5	0.00	Feb 24, 2026	Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

CVE-2026-4727HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Denial-of-service in the Libraries component in NSS. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4726HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Denial-of-service in the XML component. This vulnerability was fixed in Firefox 149 and Thunderbird 149.
CVE-2026-4719HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4714HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4713HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4712HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Information disclosure in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4709HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4708HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4707HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4706HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4704HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4699HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4697HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4695HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4694HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4693HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4686HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4685HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.01
Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-4684HigMar 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Race condition, use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.
CVE-2026-2803HigFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.49cvss 7.5epss 0.00
Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Page 32 of 94