| CVE-2026-74935 |
Privilege escalation in the DOM: Networking component
|
8.8
High
|
Aug 18, 2026 |
| CVE-2026-74936 |
Use-after-free in the JavaScript: WebAssembly component
|
9.8
Critical
|
Aug 18, 2026 |
| CVE-2026-14899 |
The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled)…
|
7.5
High
|
Jul 22, 2026 |
| CVE-2026-16361 |
Memory safety bugs present in Thunderbird ESR 140.12
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16360 |
Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16412 |
Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16411 |
Memory safety bugs present in Thunderbird 152
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16410 |
JIT miscompilation in the JavaScript Engine: JIT component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16409 |
Invalid pointer in the Security: PSM component
|
7.5
High
|
Jul 21, 2026 |
| CVE-2026-16407 |
Mitigation bypass in the DOM: Service Workers component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16408 |
Integer overflow in the Audio/Video: Playback component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16406 |
Mitigation bypass in the Networking component
|
9.1
Critical
|
Jul 21, 2026 |
| CVE-2026-16405 |
Information disclosure in the Networking: WebSockets component
|
7.5
High
|
Jul 21, 2026 |
| CVE-2026-16403 |
Spoofing issue in the Address Bar component
|
6.5
Medium
|
Jul 21, 2026 |
| CVE-2026-16401 |
Privilege escalation in the Data Loss Prevention component
|
8.8
High
|
Jul 21, 2026 |
| CVE-2026-16402 |
Integer overflow in the Graphics: ImageLib component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16400 |
Information disclosure in the DOM: Security component
|
7.5
High
|
Jul 21, 2026 |
| CVE-2026-16399 |
Site isolation issue in the DOM: Navigation component
|
7.5
High
|
Jul 21, 2026 |
| CVE-2026-16398 |
Site isolation issue in the Graphics component
|
7.5
High
|
Jul 21, 2026 |
| CVE-2026-16395 |
Integer overflow in the Audio/Video component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16396 |
Privilege escalation in WebExtensions
|
8.8
High
|
Jul 21, 2026 |
| CVE-2026-16394 |
Mitigation bypass in the DOM: Security component
|
9.1
Critical
|
Jul 21, 2026 |
| CVE-2026-16359 |
Incorrect boundary conditions in the Audio/Video: GMP component
|
9.1
Critical
|
Jul 21, 2026 |
| CVE-2026-16393 |
Incorrect boundary conditions in the Graphics: WebGPU component
|
9.1
Critical
|
Jul 21, 2026 |
| CVE-2026-16392 |
JIT miscompilation in the JavaScript Engine: JIT component
|
9.1
Critical
|
Jul 21, 2026 |