Thunderbird

Source repositories

https://github.com/mozilla/releases-comm-central

CVEs (1,945)

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2026-2797	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2796	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Feb 24, 2026	JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2795	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2793	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary…
CVE-2026-2792	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This…
CVE-2026-2791	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2790	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2789	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2788	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2787	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2786	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2785	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2784	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2782	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2781	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
CVE-2026-2780	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2779	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Feb 24, 2026	Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2777	Mozilla Corporation Firefox	Cri	0.64	9.8	0.00	Feb 24, 2026	Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2775	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Feb 24, 2026	Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2774	Mozilla Corporation Firefox	Cri	0.64	9.8	0.01	Feb 24, 2026	Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

CVE-2026-2797CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2796CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2795CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.
CVE-2026-2793CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary…
CVE-2026-2792CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This…
CVE-2026-2791CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Mitigation bypass in the Networking: Cache component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2790CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2789CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2788CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2787CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the DOM: Window and Location component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2786CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2785CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2784CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2782CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2781CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, Thunderbird 140.8, and Firefox ESR 115.35.
CVE-2026-2780CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2779CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Incorrect boundary conditions in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2777CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.00
Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2775CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
CVE-2026-2774CriFeb 24, 2026
Mozilla Corporation
Firefox
risk 0.64cvss 9.8epss 0.01
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Page 6 of 98