# Mozilla Thunderbird.

Every CVE that names Mozilla Thunderbird among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Invalid pointer in the Audio/Video: Playback component](https://agentprime.io/advisories/CVE-2026-6778.md)
  `CVE-2026-6778` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Other issue in the Networking: DNS component](https://agentprime.io/advisories/CVE-2026-6777.md)
  `CVE-2026-6777` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF), Denial of service, CWE-20
- [Incorrect boundary conditions in the WebRTC: Networking component](https://agentprime.io/advisories/CVE-2026-6776.md)
  `CVE-2026-6776` · CVE record: Mozilla Firefox and 1 more · CVSS 7.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the WebRTC component](https://agentprime.io/advisories/CVE-2026-6775.md)
  `CVE-2026-6775` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-6774.md)
  `CVE-2026-6774` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-693
- [Denial-of-service due to integer overflow in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-6773.md)
  `CVE-2026-6773` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-6772.md)
  `CVE-2026-6772` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-754
- [Mitigation bypass in the DOM: Security component](https://agentprime.io/advisories/CVE-2026-6771.md)
  `CVE-2026-6771` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Authentication bypass
- [Other issue in the Storage: IndexedDB component](https://agentprime.io/advisories/CVE-2026-6770.md)
  `CVE-2026-6770` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure
- [Privilege escalation in the Debugger component](https://agentprime.io/advisories/CVE-2026-6769.md)
  `CVE-2026-6769` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Privilege escalation
- [Mitigation bypass in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-6768.md)
  `CVE-2026-6768` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Authentication bypass
- [Other issue in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-6767.md)
  `CVE-2026-6767` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-6766.md)
  `CVE-2026-6766` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-754
- [Information disclosure in the Form Autofill component](https://agentprime.io/advisories/CVE-2026-6765.md)
  `CVE-2026-6765` · CVE record: Mozilla Firefox and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Information disclosure
- [Incorrect boundary conditions in the DOM: Device Interfaces component](https://agentprime.io/advisories/CVE-2026-6764.md)
  `CVE-2026-6764` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Mitigation bypass in the File Handling component](https://agentprime.io/advisories/CVE-2026-6763.md)
  `CVE-2026-6763` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: CWE-693
- [Spoofing issue in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-6762.md)
  `CVE-2026-6762` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Authentication bypass
- [Privilege escalation in the Networking component](https://agentprime.io/advisories/CVE-2026-6761.md)
  `CVE-2026-6761` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Privilege escalation
- [Mitigation bypass in the Networking: Cookies component](https://agentprime.io/advisories/CVE-2026-6760.md)
  `CVE-2026-6760` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Authentication bypass
- [Use-after-free in the Widget: Cocoa component](https://agentprime.io/advisories/CVE-2026-6759.md)
  `CVE-2026-6759` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Use-after-free in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-6758.md)
  `CVE-2026-6758` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Invalid pointer in the JavaScript: WebAssembly component](https://agentprime.io/advisories/CVE-2026-6757.md)
  `CVE-2026-6757` · CVE record: Mozilla Firefox and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Mitigation bypass in the DOM: postMessage component](https://agentprime.io/advisories/CVE-2026-6755.md)
  `CVE-2026-6755` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Apr 2026 · Tags: Cross-site request forgery (CSRF)
- [Use-after-free in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-6754.md)
  `CVE-2026-6754` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the WebRTC component](https://agentprime.io/advisories/CVE-2026-6753.md)
  `CVE-2026-6753` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the WebRTC component](https://agentprime.io/advisories/CVE-2026-6752.md)
  `CVE-2026-6752` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Uninitialized memory in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-6751.md)
  `CVE-2026-6751` · CVE record: Mozilla Firefox and 1 more · CVSS 7.3 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Privilege escalation in the Graphics: WebRender component](https://agentprime.io/advisories/CVE-2026-6750.md)
  `CVE-2026-6750` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 21 Apr 2026 · Tags: Privilege escalation
- [Information disclosure due to uninitialized memory in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-6749.md)
  `CVE-2026-6749` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Uninitialized memory in the Audio/Video: Web Codecs component](https://agentprime.io/advisories/CVE-2026-6748.md)
  `CVE-2026-6748` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Use-after-free in the WebRTC component](https://agentprime.io/advisories/CVE-2026-6747.md)
  `CVE-2026-6747` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Use-after-free in the DOM: Core & HTML component](https://agentprime.io/advisories/CVE-2026-6746.md)
  `CVE-2026-6746` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 21 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox 149.0.2 and Thunderbird 149.0.2](https://agentprime.io/advisories/CVE-2026-5735.md)
  `CVE-2026-5735` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2](https://agentprime.io/advisories/CVE-2026-5734.md)
  `CVE-2026-5734` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Graphics: WebGPU component](https://agentprime.io/advisories/CVE-2026-5733.md)
  `CVE-2026-5733` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption
- [Incorrect boundary conditions, integer overflow in the Graphics: Text component](https://agentprime.io/advisories/CVE-2026-5732.md)
  `CVE-2026-5732` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2](https://agentprime.io/advisories/CVE-2026-5731.md)
  `CVE-2026-5731` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Apr 2026 · Tags: Memory corruption
- [Out of bounds read in IMAP parsing](https://agentprime.io/advisories/CVE-2026-4371.md)
  `CVE-2026-4371` · CVE record: Mozilla Thunderbird · CVSS 7.4 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-126, CWE-130
- [Spoofing issue in Thunderbird](https://agentprime.io/advisories/CVE-2026-3889.md)
  `CVE-2026-3889` · CVE record: Mozilla Thunderbird · CVSS 6.5 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-451
- [Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149](https://agentprime.io/advisories/CVE-2026-4721.md)
  `CVE-2026-4721` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox 149 and Thunderbird 149](https://agentprime.io/advisories/CVE-2026-4729.md)
  `CVE-2026-4729` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149](https://agentprime.io/advisories/CVE-2026-4720.md)
  `CVE-2026-4720` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Graphics: Text component](https://agentprime.io/advisories/CVE-2026-4719.md)
  `CVE-2026-4719` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Undefined behavior in the WebRTC: Signaling component](https://agentprime.io/advisories/CVE-2026-4718.md)
  `CVE-2026-4718` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-758
- [Spoofing issue in the Privacy: Anti-Tracking component](https://agentprime.io/advisories/CVE-2026-4728.md)
  `CVE-2026-4728` · CVE record: Mozilla Firefox and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 24 Mar 2026 · Tags: Authentication bypass
- [Denial-of-service in the Libraries component in NSS](https://agentprime.io/advisories/CVE-2026-4727.md)
  `CVE-2026-4727` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Denial-of-service in the XML component](https://agentprime.io/advisories/CVE-2026-4726.md)
  `CVE-2026-4726` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Denial of service
- [Privilege escalation in the Netmonitor component](https://agentprime.io/advisories/CVE-2026-4717.md)
  `CVE-2026-4717` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026
- [Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component](https://agentprime.io/advisories/CVE-2026-4716.md)
  `CVE-2026-4716` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Uninitialized memory in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4715.md)
  `CVE-2026-4715` · CVE record: Mozilla Firefox and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-4714.md)
  `CVE-2026-4714` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754
- [Incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-4713.md)
  `CVE-2026-4713` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754
- [Information disclosure in the Widget: Cocoa component](https://agentprime.io/advisories/CVE-2026-4712.md)
  `CVE-2026-4712` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: Information disclosure
- [Sandbox escape due to use-after-free in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4725.md)
  `CVE-2026-4725` · CVE record: Mozilla Firefox and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Use-after-free in the Widget: Cocoa component](https://agentprime.io/advisories/CVE-2026-4711.md)
  `CVE-2026-4711` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video component](https://agentprime.io/advisories/CVE-2026-4710.md)
  `CVE-2026-4710` · CVE record: Mozilla Firefox and 1 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Mar 2026 · Tags: Memory corruption
- [Incorrect boundary conditions in the Audio/Video: GMP component](https://agentprime.io/advisories/CVE-2026-4709.md)
  `CVE-2026-4709` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754
- [Incorrect boundary conditions in the Graphics component](https://agentprime.io/advisories/CVE-2026-4708.md)
  `CVE-2026-4708` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754
- [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4707.md)
  `CVE-2026-4707` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754
- [Incorrect boundary conditions in the Graphics: Canvas2D component](https://agentprime.io/advisories/CVE-2026-4706.md)
  `CVE-2026-4706` · CVE record: Mozilla Firefox and 1 more · CVSS 7.5 High · Not analysed yet · Published 24 Mar 2026 · Tags: CWE-754

Newest: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md>
Older: <https://agentprime.io/advisories/technology/mozilla-thunderbird.md?cursor=WyIyMDI2LTAzLTI0VDEyOjMwOjMzLjI2MzAwMFoiLCJDVkUtMjAyNi00NzA2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=mozilla-thunderbird&cursor=WyIyMDI2LTA0LTIxVDEyOjQxOjA5Ljc0MDAwMFoiLCJDVkUtMjAyNi02Nzc5Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/mozilla-thunderbird/?cursor=WyIyMDI2LTA0LTIxVDEyOjQxOjA5Ljc0MDAwMFoiLCJDVkUtMjAyNi02Nzc5Il0>. Everything for agents: <https://agentprime.io/llms.txt>.