Mozilla Thunderbird <140.12

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical0high0medium0low

updated 2026-10-28

vulnerabilities (42)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-12295US	—	0.39% (33rd)	Exploit	no fix	2026-06-16	—
CVE-2026-12292US	—	0.49% (42nd)	—	no fix	2026-06-16	—
CVE-2026-12328US	—	0.48% (41st)	—	no fix	2026-06-16	—
CVE-2026-12327US	—	0.41% (35th)	—	no fix	2026-06-16	—
CVE-2026-12290US	—	0.40% (34th)	—	no fix	2026-06-16	—
CVE-2026-12289US	—	0.40% (34th)	—	no fix	2026-06-16	—
CVE-2026-12297US	—	0.39% (33rd)	—	no fix	2026-06-16	—
CVE-2026-12296US	—	0.39% (33rd)	—	no fix	2026-06-16	—
CVE-2026-12291US	—	0.38% (32nd)	—	no fix	2026-06-16	—
CVE-2026-12305US	—	0.37% (31st)	—	no fix	2026-06-16	—
CVE-2026-12326US	—	0.36% (30th)	—	no fix	2026-06-16	—
CVE-2026-12294US	—	0.36% (30th)	—	no fix	2026-06-16	—
CVE-2026-12329US	—	0.31% (24th)	—	no fix	2026-06-16	—
CVE-2026-12299US	—	0.31% (23rd)	—	no fix	2026-06-16	—
CVE-2026-12298US	—	0.31% (23rd)	—	no fix	2026-06-16	—
CVE-2026-12293US	critical9.8	0.30% (23rd)	—	no fix	2026-06-16	—
CVE-2026-12317US	—	0.29% (21st)	—	no fix	2026-06-16	—
CVE-2026-12318US	—	0.26% (18th)	—	no fix	2026-06-16	—
CVE-2026-12308US	—	0.26% (18th)	—	no fix	2026-06-16	—
CVE-2026-12307US	—	0.26% (18th)	—	no fix	2026-06-16	—
CVE-2026-12306US	—	0.26% (18th)	—	no fix	2026-06-16	—
CVE-2026-12314US	—	0.25% (17th)	—	no fix	2026-06-16	—
CVE-2026-12312US	—	0.25% (17th)	—	no fix	2026-06-16	—
CVE-2026-12310US	—	0.25% (17th)	—	no fix	2026-06-16	—
CVE-2026-12301US	—	0.25% (17th)	—	no fix	2026-06-16	—
CVE-2026-12300US	—	0.25% (17th)	—	no fix	2026-06-16	—
CVE-2026-12315US	—	0.25% (16th)	—	no fix	2026-06-16	—
CVE-2026-12302US	—	0.25% (16th)	—	no fix	2026-06-16	—
CVE-2026-12316US	—	0.24% (16th)	—	no fix	2026-06-16	—
CVE-2026-12309US	—	0.24% (14th)	—	no fix	2026-06-16	—
CVE-2026-12325US	—	0.23% (13th)	—	no fix	2026-06-16	—
CVE-2026-12303US	—	0.22% (13th)	—	no fix	2026-06-16	—
CVE-2026-12319US	—	0.21% (11th)	—	no fix	2026-06-16	—
CVE-2026-12324US	—	0.21% (11th)	—	no fix	2026-06-16	—
CVE-2026-12322US	—	0.21% (11th)	—	no fix	2026-06-16	—
CVE-2026-12304US	—	0.19% (8th)	—	no fix	2026-06-16	—
CVE-2026-12311US	—	0.18% (8th)	—	no fix	2026-06-16	—
CVE-2026-12320US	—	0.18% (7th)	—	no fix	2026-06-16	—
CVE-2026-12313US	—	0.18% (7th)	—	no fix	2026-06-16	—
CVE-2026-12323US	—	0.17% (6th)	—	no fix	2026-06-16	—
CVE-2026-12330US	—	0.16% (6th)	—	no fix	2026-06-16	—
CVE-2026-12321US	—	0.16% (5th)	—	no fix	2026-06-16	—

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer19 CVEs
CWE-416Use After Free6 CVEs
CWE-693Protection Mechanism Failure6 CVEs
CWE-125Out-of-bounds Read4 CVEs
CWE-787Out-of-bounds Write4 CVEs
CWE-825Expired Pointer Dereference4 CVEs
CWE-1021Improper Restriction of Rendered UI Layers or Frames2 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)42 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan