# Mozilla Thunderbird. Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Memory safety bug fixed in Firefox 144 and Thunderbird 144](https://agentprime.io/advisories/CVE-2025-11721.md) `CVE-2025-11721` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Use-after-free caused by the native messaging web extension API on Windows](https://agentprime.io/advisories/CVE-2025-11719.md) `CVE-2025-11719` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Sandboxed iframes allowed links to open in external apps (Android only)](https://agentprime.io/advisories/CVE-2025-11716.md) `CVE-2025-11716` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: Broken access control - [Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144](https://agentprime.io/advisories/CVE-2025-11715.md) `CVE-2025-11715` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Potential user-assisted code execution in “Copy as cURL” command](https://agentprime.io/advisories/CVE-2025-11713.md) `CVE-2025-11713` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-116 - [An OBJECT tag type attribute overrode browser behavior on web resources without a content-type](https://agentprime.io/advisories/CVE-2025-11712.md) `CVE-2025-11712` · CVE record: Mozilla Firefox and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-116 - [Use-after-free in MediaTrackGraphImpl::GetInstance()](https://agentprime.io/advisories/CVE-2025-11708.md) `CVE-2025-11708` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144](https://agentprime.io/advisories/CVE-2025-11714.md) `CVE-2025-11714` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Some non-writable Object properties could be modified](https://agentprime.io/advisories/CVE-2025-11711.md) `CVE-2025-11711` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2025 · Tags: CWE-591 - [Cross-process information leaked due to malicious IPC messages](https://agentprime.io/advisories/CVE-2025-11710.md) `CVE-2025-11710` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Information disclosure - [Out of bounds read/write in a privileged process triggered by WebGL textures](https://agentprime.io/advisories/CVE-2025-11709.md) `CVE-2025-11709` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2025 · Tags: Memory corruption - [Spoofing issue in the Site Permissions component](https://agentprime.io/advisories/CVE-2025-10534.md) `CVE-2025-10534` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 16 Sept 2025 · Tags: Cross-site scripting (XSS) - [Mitigation bypass in the Web Compatibility: Tooling component](https://agentprime.io/advisories/CVE-2025-10531.md) `CVE-2025-10531` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Authentication bypass - [Spoofing issue in the WebAuthn component in Firefox for Android](https://agentprime.io/advisories/CVE-2025-10530.md) `CVE-2025-10530` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Authentication bypass - [Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143](https://agentprime.io/advisories/CVE-2025-10537.md) `CVE-2025-10537` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2025 · Tags: Memory corruption - [Information disclosure in the Networking: Cache component](https://agentprime.io/advisories/CVE-2025-10536.md) `CVE-2025-10536` · CVE record: Mozilla Firefox and 1 more · CVSS 6.2 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: Information disclosure - [Incorrect boundary conditions in the JavaScript: GC component](https://agentprime.io/advisories/CVE-2025-10532.md) `CVE-2025-10532` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-754 - [Same-origin policy bypass in the Layout component](https://agentprime.io/advisories/CVE-2025-10529.md) `CVE-2025-10529` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-942 - [Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-10528.md) `CVE-2025-10528` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 16 Sept 2025 · Tags: CWE-693 - [Sandbox escape due to use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-10527.md) `CVE-2025-10527` · CVE record: Mozilla Firefox and 1 more · CVSS 7.1 High · Not analysed yet · Published 16 Sept 2025 · Tags: Memory corruption - [Integer overflow in the SVG component](https://agentprime.io/advisories/CVE-2025-10533.md) `CVE-2025-10533` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142](https://agentprime.io/advisories/CVE-2025-9184.md) `CVE-2025-9184` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox 142 and Thunderbird 142](https://agentprime.io/advisories/CVE-2025-9187.md) `CVE-2025-9187` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Denial-of-service due to out-of-memory in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2025-9182.md) `CVE-2025-9182` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 19 Aug 2025 · Tags: Denial of service - [Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142](https://agentprime.io/advisories/CVE-2025-9185.md) `CVE-2025-9185` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Uninitialized memory in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2025-9181.md) `CVE-2025-9181` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Same-origin policy bypass in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2025-9180.md) `CVE-2025-9180` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 19 Aug 2025 · Tags: CWE-346 - [Sandbox escape due to invalid pointer in the Audio/Video: GMP component](https://agentprime.io/advisories/CVE-2025-9179.md) `CVE-2025-9179` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Aug 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8044.md) `CVE-2025-8044` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8035.md) `CVE-2025-8035` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8040.md) `CVE-2025-8040` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141](https://agentprime.io/advisories/CVE-2025-8034.md) `CVE-2025-8034` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Incorrect JavaScript state machine for generators](https://agentprime.io/advisories/CVE-2025-8033.md) `CVE-2025-8033` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Search terms persisted in URL bar](https://agentprime.io/advisories/CVE-2025-8039.md) `CVE-2025-8039` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Information disclosure - [CSP frame-src was not correctly enforced for paths](https://agentprime.io/advisories/CVE-2025-8038.md) `CVE-2025-8038` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-345 - [XSLT documents could bypass CSP](https://agentprime.io/advisories/CVE-2025-8032.md) `CVE-2025-8032` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-693 - [Incorrect URL stripping in CSP reports](https://agentprime.io/advisories/CVE-2025-8031.md) `CVE-2025-8031` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: Broken access control - [Potential user-assisted code execution in “Copy as cURL” command](https://agentprime.io/advisories/CVE-2025-8030.md) `CVE-2025-8030` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Code injection - [Nameless cookies shadow secure cookies](https://agentprime.io/advisories/CVE-2025-8037.md) `CVE-2025-8037` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-614 - [DNS rebinding circumvents CORS](https://agentprime.io/advisories/CVE-2025-8036.md) `CVE-2025-8036` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-350 - [javascript: URLs executed on object and embed tags](https://agentprime.io/advisories/CVE-2025-8029.md) `CVE-2025-8029` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Cross-site scripting (XSS) - [Large branch table could lead to truncated instruction](https://agentprime.io/advisories/CVE-2025-8028.md) `CVE-2025-8028` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: CWE-1332 - [JavaScript engine only wrote partial return value to stack](https://agentprime.io/advisories/CVE-2025-8027.md) `CVE-2025-8027` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 22 Jul 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox 140 and Thunderbird 140](https://agentprime.io/advisories/CVE-2025-6436.md) `CVE-2025-6436` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 24 Jun 2025 · Tags: Memory corruption - [Save as in Devtools could download files without sanitizing the extension](https://agentprime.io/advisories/CVE-2025-6435.md) `CVE-2025-6435` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 24 Jun 2025 · Tags: Unrestricted file upload - [HTTPS-Only exception screen lacked anti-clickjacking delay](https://agentprime.io/advisories/CVE-2025-6434.md) `CVE-2025-6434` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-1021 - [WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate](https://agentprime.io/advisories/CVE-2025-6433.md) `CVE-2025-6433` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2025 · Tags: Weak cryptography or TLS - [DNS Requests leaked outside of a configured SOCKS proxy](https://agentprime.io/advisories/CVE-2025-6432.md) `CVE-2025-6432` · CVE record: Mozilla Firefox and 1 more · CVSS 8.6 High · Not analysed yet · Published 24 Jun 2025 · Tags: Information disclosure - [connect-src Content Security Policy restriction could be bypassed](https://agentprime.io/advisories/CVE-2025-6427.md) `CVE-2025-6427` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-693 - [Content-Disposition header ignored when a file is included in an embed or object tag](https://agentprime.io/advisories/CVE-2025-6430.md) `CVE-2025-6430` · CVE record: Mozilla Firefox and 1 more · CVSS 6.1 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: Cross-site scripting (XSS) - [Incorrect parsing of URLs could have allowed embedding of youtube.com](https://agentprime.io/advisories/CVE-2025-6429.md) `CVE-2025-6429` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-116 - [No warning when opening executable terminal files on macOS](https://agentprime.io/advisories/CVE-2025-6426.md) `CVE-2025-6426` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 24 Jun 2025 · Tags: CWE-345 - [The WebCompat WebExtension shipped with Firefox exposed a persistent UUID](https://agentprime.io/advisories/CVE-2025-6425.md) `CVE-2025-6425` · CVE record: Mozilla Firefox and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 24 Jun 2025 · Tags: Information disclosure - [Use-after-free in FontFaceSet](https://agentprime.io/advisories/CVE-2025-6424.md) `CVE-2025-6424` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Jun 2025 · Tags: Memory corruption - [Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links](https://agentprime.io/advisories/CVE-2025-5986.md) `CVE-2025-5986` · CVE record: Mozilla Thunderbird · CVSS 6.5 Medium · Not analysed yet · Published 11 Jun 2025 · Tags: CWE-451 - [Memory safety bugs fixed in Firefox 139 and Thunderbird 139](https://agentprime.io/advisories/CVE-2025-5272.md) `CVE-2025-5272` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 27 May 2025 · Tags: Memory corruption - [Devtools' preview ignored CSP headers](https://agentprime.io/advisories/CVE-2025-5271.md) `CVE-2025-5271` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 May 2025 · Tags: CWE-116 - [SNI was sometimes unencrypted](https://agentprime.io/advisories/CVE-2025-5270.md) `CVE-2025-5270` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 27 May 2025 · Tags: Weak cryptography or TLS - [Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11](https://agentprime.io/advisories/CVE-2025-5269.md) `CVE-2025-5269` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 May 2025 · Tags: Memory corruption - [Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11](https://agentprime.io/advisories/CVE-2025-5268.md) `CVE-2025-5268` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 May 2025 · Tags: Memory corruption Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .