| CVE-2026-16369 |
Integer overflow in the JavaScript: WebAssembly component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16367 |
Sandbox escape due to invalid pointer in the Disability Access APIs component
|
10.0
Critical
|
Jul 21, 2026 |
| CVE-2026-16368 |
Incorrect boundary conditions in the JavaScript: WebAssembly component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16354 |
Information disclosure in the Graphics: ImageLib component
|
7.5
High
|
Jul 21, 2026 |
| CVE-2026-16353 |
Invalid pointer in the DOM: Bindings (WebIDL) component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16366 |
Privilege escalation in the DOM: Navigation component
|
8.8
High
|
Jul 21, 2026 |
| CVE-2026-16365 |
Privilege escalation in the DOM: Workers component
|
8.8
High
|
Jul 21, 2026 |
| CVE-2026-16363 |
JIT miscompilation in the JavaScript: WebAssembly component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16364 |
Incorrect boundary conditions in the Audio/Video: Playback component
|
9.1
Critical
|
Jul 21, 2026 |
| CVE-2026-16352 |
Sandbox escape due to use-after-free in the Disability Access APIs component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16351 |
Sandbox escape due to use-after-free in the DOM: Navigation component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16362 |
Use-after-free in the WebRTC: Audio/Video component
|
8.8
High
|
Jul 21, 2026 |
| CVE-2026-16350 |
Incorrect boundary conditions in the Audio/Video: cubeb component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-16349 |
Same-origin policy bypass in the DOM: Navigation component
|
9.8
Critical
|
Jul 21, 2026 |
| CVE-2026-15719 |
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw
|
5.4
Medium
|
Jul 14, 2026 |
| CVE-2026-15718 |
We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw
|
4.3
Medium
|
Jul 14, 2026 |
| CVE-2026-57963 |
An attacker who can send HTML chat messages (via Matrix or XMPP) can inject arbitrary styled content, phishing links,…
|
6.5
Medium
|
Jul 1, 2026 |
| CVE-2026-57962 |
A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash…
|
5.3
Medium
|
Jul 1, 2026 |
| CVE-2026-12330 |
Incorrect boundary conditions in the Internationalization component
|
5.4
Medium
|
Jun 16, 2026 |
| CVE-2026-12329 |
Memory safety bug fixed in Thunderbird ESR 140.12
|
5.3
Medium
|
Jun 16, 2026 |
| CVE-2026-12328 |
Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and…
|
8.1
High
|
Jun 16, 2026 |
| CVE-2026-12327 |
Memory safety bugs present in Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151
|
8.1
High
|
Jun 16, 2026 |
| CVE-2026-12326 |
Memory safety bugs present in Firefox 151 and Thunderbird 151
|
8.1
High
|
Jun 16, 2026 |
| CVE-2026-12325 |
Denial-of-service in the Graphics: ImageLib component
|
6.5
Medium
|
Jun 16, 2026 |
| CVE-2026-12324 |
Incorrect boundary conditions in the Graphics: CanvasWebGL component
|
7.3
High
|
Jun 16, 2026 |