Thunderbird esr

This hub aggregates every CVE we track for Thunderbird esr, a product in the consumer software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Thunderbird esr.

• CVE-2026-6786Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 1507.5Apr 21, 2026
• CVE-2026-6785Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 1507.5Apr 21, 2026
• CVE-2026-5734Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.29.8Apr 7, 2026
• CVE-2026-5731Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.29.8Apr 7, 2026
• CVE-2026-0891Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 1478.1Jan 13, 2026
• CVE-2025-3523User Interface (UI) Misrepresentation of attachment URL6.4Apr 15, 2025
• CVE-2025-3522Leak of hashed Window credentials via crafted attachment URL6.3Apr 15, 2025
• CVE-2025-2830Information Disclosure of /tmp directory listing6.3Apr 15, 2025
• CVE-2025-26695Downloading of OpenPGP keys from WKD used incorrect padding5.3Mar 10, 2025
• CVE-2025-26696Crafted email message incorrectly shown as being encrypted7.0Mar 10, 2025
• CVE-2025-1938Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.86.5Mar 4, 2025
• CVE-2025-1936Adding %00 and a fake extension to a jar: URL changed the interpretation of the contents7.3Mar 4, 2025
• CVE-2025-1937Memory safety bugs fixed in Firefox 136, Thunderbird 136, Firefox ESR 115.21, Firefox ESR 128.8, and Thunderbird 128.87.5Mar 4, 2025
• CVE-2025-1935Clickjacking the registerProtocolHandler info-bar4.3Mar 4, 2025
• CVE-2025-1934Unexpected GC during RegExp bailout processing6.5Mar 4, 2025