Mozilla Thunderbird

• CVE-2025-11719 Critical 9.8 Use-after-free caused by the native messaging web extension API on Windows 0.4%
• CVE-2025-11716 Medium 6.5 Sandboxed iframes allowed links to open in external apps (Android only) 0.2%
• CVE-2025-11715 High 8.8 Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 0.3%
• CVE-2025-11713 High 8.1 Potential user-assisted code execution in “Copy as cURL” command 0.3%
• CVE-2025-11712 Medium 6.1 An OBJECT tag type attribute overrode browser behavior on web resources without a content-type 0.2%
• CVE-2025-11708 Critical 9.8 Use-after-free in MediaTrackGraphImpl::GetInstance() 0.5%
• CVE-2025-11714 High 8.8 Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 0.3%
• CVE-2025-11711 Medium 6.5 Some non-writable Object properties could be modified 0.2%
• CVE-2025-11710 Critical 9.8 Cross-process information leaked due to malicious IPC messages 0.4%
• CVE-2025-11709 Critical 9.8 Out of bounds read/write in a privileged process triggered by WebGL textures 0.4%
• CVE-2025-10534 High 8.1 Spoofing issue in the Site Permissions component 0.4%
• CVE-2025-10531 Medium 5.4 Mitigation bypass in the Web Compatibility: Tooling component 0.3%
• CVE-2025-10530 Medium 6.5 Spoofing issue in the WebAuthn component in Firefox for Android 0.3%
• CVE-2025-10537 High 8.8 Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 0.3%
• CVE-2025-10536 Medium 6.2 Information disclosure in the Networking: Cache component 0.2%
• CVE-2025-10532 Medium 6.5 Incorrect boundary conditions in the JavaScript: GC component 0.3%
• CVE-2025-10529 Medium 6.5 Same-origin policy bypass in the Layout component 0.3%
• CVE-2025-10528 High 7.3 Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component 0.4%
• CVE-2025-10527 High 7.1 Sandbox escape due to use-after-free in the Graphics: Canvas2D component 0.3%
• CVE-2025-10533 High 8.8 Integer overflow in the SVG component 0.8%
• CVE-2025-9184 High 8.1 Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 0.4%
• CVE-2025-9187 Critical 9.8 Memory safety bugs fixed in Firefox 142 and Thunderbird 142 0.5%
• CVE-2025-9182 High 7.5 Denial-of-service due to out-of-memory in the Graphics: WebRender component 0.4%
• CVE-2025-9185 High 8.1 Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 0.5%
• CVE-2025-9181 Medium 6.5 Uninitialized memory in the JavaScript Engine component 0.4%
• CVE-2025-9180 High 8.1 Same-origin policy bypass in the Graphics: Canvas2D component 0.3%
• CVE-2025-9179 Critical 9.8 Sandbox escape due to invalid pointer in the Audio/Video: GMP component 0.6%
• CVE-2025-8044 Critical 9.8 Memory safety bugs fixed in Firefox 141 and Thunderbird 141 0.5%
• CVE-2025-8035 High 8.8 Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 0.4%
• CVE-2025-8040 High 8.8 Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 0.4%
• CVE-2025-8034 High 8.8 Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 0.5%
• CVE-2025-8033 Medium 6.5 Incorrect JavaScript state machine for generators 0.4%
• CVE-2025-8039 High 8.1 Search terms persisted in URL bar 0.3%
• CVE-2025-8038 Critical 9.8 CSP frame-src was not correctly enforced for paths 0.3%
• CVE-2025-8032 High 8.1 XSLT documents could bypass CSP 0.4%
• CVE-2025-8031 Critical 9.8 Incorrect URL stripping in CSP reports 0.5%
• CVE-2025-8030 High 8.1 Potential user-assisted code execution in “Copy as cURL” command 0.4%
• CVE-2025-8037 Critical 9.1 Nameless cookies shadow secure cookies 0.3%
• CVE-2025-8036 High 8.1 DNS rebinding circumvents CORS 0.4%
• CVE-2025-8029 High 8.1 javascript: URLs executed on object and embed tags 0.4%
• CVE-2025-8028 Critical 9.8 Large branch table could lead to truncated instruction 0.6%
• CVE-2025-8027 Medium 6.5 JavaScript engine only wrote partial return value to stack 0.4%
• CVE-2025-6436 High 8.1 Memory safety bugs fixed in Firefox 140 and Thunderbird 140 4.3%
• CVE-2025-6435 High 8.1 Save as in Devtools could download files without sanitizing the extension 0.5%
• CVE-2025-6434 Medium 4.3 HTTPS-Only exception screen lacked anti-clickjacking delay 0.3%
• CVE-2025-6433 Critical 9.8 WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate 0.3%
• CVE-2025-6432 High 8.6 DNS Requests leaked outside of a configured SOCKS proxy 0.4%
• CVE-2025-6427 Critical 9.1 connect-src Content Security Policy restriction could be bypassed 0.4%
• CVE-2025-6430 Medium 6.1 Content-Disposition header ignored when a file is included in an embed or object tag 0.3%
• CVE-2025-6429 Medium 6.5 Incorrect parsing of URLs could have allowed embedding of youtube.com 0.4%