Technology · Mozilla
Mozilla Thunderbird vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 396 vulnerabilities in Mozilla Thunderbird: 5 in the last 7 days and 255 in the last 90 days, 114 of them critical and 13 exploited in the wild. The most recent, CVE-2026-126136, was published on 10 November 2026. 91 vulnerabilities in the last four weeks, up 18% on the four before (77). 4 critical against 21.
- Last 7 days
- 5
- Last 90 days
- 255
- Critical, all time
- 114
- Exploited in the wild
- 13
About Mozilla Thunderbird
Thunderbird is a free and open-source cross-platform email client, personal information manager, news client, RSS and chat client developed by the Mozilla Foundation.
Latest Mozilla Thunderbird vulnerabilities
- CVE-2026-126136: Thunderbird OAuth2 access token leak over HTTP with Exchange accountsinfo
- CVE-2026-126135: Mozilla Thunderbird SMTP/POP3 response injection via STARTTLSinfo
- CVE-2026-126134: Thunderbird NTLM credential leak via feed subscription to file URLinfo
- CVE-2026-126133: Thunderbird calendar server credentials sent to HTTP proxyinfo
- CVE-2026-126132: Thunderbird attachment replacement disclosure via link filesinfo
- CVE-2026-118180: Thunderbird Matrix homeserver URL validation bypassinfo
- CVE-2026-118179: Mozilla Thunderbird request forgery via news: linksinfo
- CVE-2026-118178: Mozilla Thunderbird RSS feed URL redirection to file: URLinfo
- CVE-2026-118177: Mozilla Thunderbird calendar discovery accepts local files and network sharesinfo
- CVE-2026-118176: Thunderbird mailbox: URL UNC path restriction bypass on Windowsinfo
- CVE-2026-118175: Mozilla Thunderbird message content disclosure in reply/forwardinfo
- CVE-2026-118174: Mozilla Thunderbird OpenPGP key attachment remote content loadinginfo
- CVE-2026-113869: Thunderbird use-after-free in S/MIME decryptionmediumCVSS 5.4
- CVE-2026-113868: Thunderbird uninitialized memory disclosure in NTLM authenticationmediumCVSS 5.3
- CVE-2026-113867: Thunderbird XMPP stanza injection in chatinfo
- CVE-2026-113866: Mozilla Thunderbird account password disclosure in Exchange AutoDiscovermediumCVSS 5.9
- CVE-2026-110249: Thunderbird denial-of-service in Exchange componentinfoEPSS 0.2%
- CVE-2026-110247: Mozilla Thunderbird integer overflow in libmime buffer growthinfoEPSS 0.2%
- CVE-2026-109783: Mozilla Firefox ESR mitigation bypass in File HandlinginfoEPSS 0.2%
- CVE-2026-109782: Mozilla Firefox ESR and Thunderbird mitigation bypass in File HandlinginfoEPSS 0.2%
- CVE-2026-109781: Mozilla Firefox denial-of-service in Printing: OutputmediumCVSS 6.5EPSS 0.3%
- CVE-2026-109780: Firefox mitigation bypass in DOM: Core & HTMLinfoEPSS 0.2%
- CVE-2026-109779: Firefox race condition in Networking DNS componentmediumCVSS 4.2EPSS 0.1%
- CVE-2026-109778: Mozilla Firefox privilege escalation in WebExtensionshighCVSS 8.8EPSS 0.3%
- CVE-2026-109777: Firefox Information disclosure in Storage: IndexedDBmediumCVSS 4.3EPSS 0.2%
Most severe Mozilla Thunderbird vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2019-11708: Mozilla Firefox and Thunderbird Sandbox Escape Vulnerabilitycriticalexploited in the wildCVSS 10
- CVE-2010-3765: Mozilla Multiple Products memory corruption in nsCSSFrameConstructorcriticalexploited in the wildCVSS 9.8EPSS 86.6%
- CVE-2024-9680: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.8
- CVE-2022-26486: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 9.6
- CVE-2015-4495: Mozilla Firefox Security Feature Bypass Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-11707: Mozilla Firefox and Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2013-1690: Mozilla Firefox and Thunderbird Denial-of-Service Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2022-26485: Mozilla Firefox Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2019-17026: Mozilla Firefox And Thunderbird Type Confusion Vulnerabilitycriticalexploited in the wildCVSS 8.8
- CVE-2020-6819: Mozilla Firefox And Thunderbird Use-After-Free Vulnerabilitycriticalexploited in the wildCVSS 8.1
Vulnerabilities per week
91 vulnerabilities in the last four weeks, up 18% on the four before (77). 4 critical against 21. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 52 | 15 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 30 | 10 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 76 | 21 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 1 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 80 | 4 | |
| 19 Oct 2026 | 4 | 0 | |
| 26 Oct 2026 | 7 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 5 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Mozilla Thunderbird vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/thunderbird)<a href="https://junglewise.ai/threats/technologies/thunderbird"><img src="https://junglewise.ai/threats/technologies/thunderbird/badge.svg" alt="Mozilla Thunderbird vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/thunderbird.json, and this page as text at https://junglewise.ai/threats/technologies/thunderbird.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Mozilla Thunderbird vulnerabilities", https://junglewise.ai/threats/technologies/thunderbird, 13 November 2026.