TI-2026-84258 CVE-2026-120572 · GHSA-5rc2-pf3x-xh5v
Incorrect boundary conditions in Mozilla Firefox Layout component
Priority MEDIUM 40
Incorrect boundary conditions in the Layout: Block and Inline component.
Vulnerabilities
4205 records
TI-2026-81512 CVE-2026-118180 · GHSA-x88m-7whj-m9mh
Matrix homeserver can redirect Thunderbird session to local files
Priority LOW 39
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.
TI-2026-81511 CVE-2026-118179 · GHSA-gm4x-83qc-5rx5
Request forgery in Mozilla Thunderbird via news: links
Priority MEDIUM 40
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server.
TI-2026-81510 CVE-2026-118178 · GHSA-6j4v-p75m-p9wm
RSS feed redirects Thunderbird subscription to local file or share
Priority LOW 25
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.
TI-2026-81509 CVE-2026-118177 · GHSA-7w88-6r56-g2q9
Thunderbird calendar discovery accepts local file and share locations
Priority MEDIUM 46
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares.
TI-2026-81508 CVE-2026-118176 · GHSA-g4vf-4v95-x4pc
Thunderbird mailbox: URL check bypass exposes Windows NTLM data
Priority LOW 37
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths.
TI-2026-81507 CVE-2026-118175 · GHSA-wc7r-3c8h-4jrf
Thunderbird may include other messages' content in replies
Priority LOW 39
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content w…
TI-2026-81506 CVE-2026-118174 · GHSA-7h4p-h257-qp65
Thunderbird loads attacker-chosen URL from OpenPGP key attachment
Priority LOW 29
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key.
TI-2026-81352 CVE-2026-118027 · GHSA-38v7-8p8g-jfff
Frame poisoning in the Mozilla Firefox Layout component
Priority MEDIUM 45
Frame poisoning in the Layout component.
TI-2026-81351 CVE-2026-118026 · GHSA-65jj-p45m-rp83
Invalid pointer in JavaScript GC in Firefox and Thunderbird
Priority MEDIUM 40
Invalid pointer in the JavaScript: GC component.
TI-2026-81350 CVE-2026-118025 · GHSA-9h5j-68x4-pjqx
Input validation flaw in Mozilla Firefox SVG component
Priority MEDIUM 40
Other issue in the SVG component.
TI-2026-81349 CVE-2026-118024 · GHSA-935v-p3rc-7qm7
Use-after-free in Mozilla Firefox and Thunderbird Graphics: Text
Priority MEDIUM 40
Use-after-free in the Graphics: Text component.
TI-2026-81348 CVE-2026-118023 · GHSA-2fvm-8qcx-rf42
Sandbox escape via use-after-free in Firefox WebRender
Priority MEDIUM 40
Sandbox escape due to use-after-free in the Graphics: WebRender component.
TI-2026-81347 CVE-2026-118022 · GHSA-5x82-59v9-v7hq
Sandbox escape via use-after-free in Mozilla Firefox and Thunderbird
Priority MEDIUM 40
Sandbox escape due to use-after-free in the Disability Access APIs component.
TI-2026-81346 CVE-2026-118021 · GHSA-3hc8-89qm-6758
Use-after-free in Firefox XPCOM component allows sandbox escape
Priority MEDIUM 40
Sandbox escape due to use-after-free in the XPCOM component.
TI-2026-81345 CVE-2026-118020 · GHSA-6p8p-22p3-v6rg
Use-after-free in Mozilla Firefox and Thunderbird Layout component
Priority MEDIUM 40
Use-after-free in the Layout component.
TI-2026-81344 CVE-2026-118019 · GHSA-v636-fg4v-7pgq
Race condition and use-after-free in Firefox DOM File component
Priority LOW 39
Race condition, use-after-free in the DOM: File component.
TI-2026-81343 CVE-2026-118018 · GHSA-99x8-xf9r-wr4q
Spoofing issue in Downloads component in Firefox for Android
Priority LOW 39
Spoofing issue in the Downloads component in Firefox for Android.
TI-2026-81342 CVE-2026-118017 · GHSA-xg7j-3rg5-qcww
Use-after-free in the SVG component of Firefox and Thunderbird
Priority MEDIUM 40
Use-after-free in the SVG component.
TI-2026-81341 CVE-2026-118016 · GHSA-65pv-f352-4j39
Use-after-free in Firefox and Thunderbird DOM component
Priority MEDIUM 40
Use-after-free in the DOM: Core & HTML component.
TI-2026-81340 CVE-2026-118015 · GHSA-rvq8-3879-rwq4
Use-after-free in Mozilla Firefox and Thunderbird DOM component
Priority MEDIUM 40
Use-after-free in the DOM: Core & HTML component.
TI-2026-81339 CVE-2026-118014 · GHSA-x7mr-7vx6-qw3m
Use-after-free in Mozilla Firefox and Thunderbird JavaScript JIT engine
Priority MEDIUM 40
Use-after-free in the JavaScript Engine: JIT component.
TI-2026-81338 CVE-2026-118013 · GHSA-f532-6vwv-5jpv
Use-after-free in the Layout component of Firefox and Thunderbird
Priority MEDIUM 40
Use-after-free in the Layout: Images, Video, and HTML Frames component.
TI-2026-81337 CVE-2026-118012 · GHSA-43mj-8j42-46jx
Use-after-free in Mozilla Firefox DOM Animation component
Priority MEDIUM 40
Use-after-free in the DOM: Animation component.
TI-2026-81336 CVE-2026-118011 · GHSA-q583-7wf7-8qjw
Frame poisoning in Mozilla Firefox and Thunderbird
Priority MEDIUM 40
Frame poisoning in the CSS Parsing and Computation component.