BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Mozilla

Security Vulnerabilities fixed in Thunderbird 153.6

MFSA2026-122 Oct 27, 2026 Source: Vendor

Imported from Mozilla security advisory MFSA2026-122. Draft.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://www.mozilla.org/en-US/security/advisories/mfsa2026-122/
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

154 lines
All 154 CVEs 154 Additional recognition 0 Unclaimed only
Showing 51–100 of 154 , page 2 of 4
CVE-2026-117901 BR2026-0000-036551 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117902 BR2026-0000-036552 unclaimed
High: Use-after-free in the Layout: Text and Fonts component
Credited as Mozilla
CVE-2026-117903 BR2026-0000-036553 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117904 BR2026-0000-036554 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117905 BR2026-0000-036555 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117906 BR2026-0000-036556 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as Mozilla
CVE-2026-117907 BR2026-0000-036557 unclaimed
High: Use-after-free in the Networking component
Credited as Mozilla
CVE-2026-117908 BR2026-0000-036558 unclaimed
High: Use-after-free in the Graphics: ImageLib component
Credited as Mozilla
CVE-2026-117909 BR2026-0000-036559 unclaimed
High: Use-after-free in the JavaScript: GC component
Credited as Mozilla
CVE-2026-117910 BR2026-0000-036560 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as Mozilla
CVE-2026-117911 BR2026-0000-036561 unclaimed
High: Use-after-free in the Audio/Video: Playback component
Credited as Mozilla
CVE-2026-117912 BR2026-0000-036562 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Takashi Suzuki
CVE-2026-117913 BR2026-0000-036563 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117914 BR2026-0000-036564 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117915 BR2026-0000-036565 unclaimed
High: Incorrect boundary conditions in the Layout: Block and Inline component
Credited as Mozilla
CVE-2026-117916 BR2026-0000-036566 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117917 BR2026-0000-036567 unclaimed
High: Invalid pointer in the Graphics: WebRender component
Credited as Nguyen Tuan Hung
CVE-2026-117918 BR2026-0000-036568 unclaimed
High: Use-after-free in the Graphics: Canvas2D component
Credited as Mozilla
CVE-2026-117919 BR2026-0000-036569 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117920 BR2026-0000-036570 unclaimed
High: Use-after-free in the DOM: HTML Parser component
Credited as Mozilla
CVE-2026-117921 BR2026-0000-036571 unclaimed
High: Use-after-free in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117922 BR2026-0000-036572 unclaimed
High: Use-after-free in the Networking: WebSockets component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117923 BR2026-0000-036573 unclaimed
High: Use-after-free in the Audio/Video component
Credited as Mozilla
CVE-2026-117924 BR2026-0000-036574 unclaimed
High: Use-after-free in the XSLT component
Credited as Mozilla
CVE-2026-117925 BR2026-0000-036575 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117926 BR2026-0000-036576 unclaimed
High: Incorrect boundary conditions in the SVG component
Credited as Mozilla
CVE-2026-117927 BR2026-0000-036577 unclaimed
High: Use-after-free in the SVG component
Credited as Mozilla
CVE-2026-117928 BR2026-0000-036578 unclaimed
High: Same-origin policy bypass in the CSS Parsing and Computation component
Credited as Minseong Kim
CVE-2026-117929 BR2026-0000-036579 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as Mozilla
CVE-2026-117930 BR2026-0000-036580 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117931 BR2026-0000-036581 unclaimed
High: Use-after-free in the DOM: Events component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117932 BR2026-0000-036582 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117933 BR2026-0000-036583 unclaimed
High: Frame poisoning in the CSS Parsing and Computation component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117934 BR2026-0000-036584 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117935 BR2026-0000-036585 unclaimed
High: Use-after-free in the DOM: Bindings (WebIDL) component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117936 BR2026-0000-036586 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117937 BR2026-0000-036587 unclaimed
High: Invalid pointer in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117938 BR2026-0000-036588 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117939 BR2026-0000-036589 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117940 BR2026-0000-036590 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117941 BR2026-0000-036591 unclaimed
High: Use-after-free in the DOM: CSS Object Model component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117942 BR2026-0000-036592 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine: JIT component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117943 BR2026-0000-036593 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117944 BR2026-0000-036594 unclaimed
High: Use-after-free in the Layout component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117945 BR2026-0000-036595 unclaimed
High: Incorrect boundary conditions in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117946 BR2026-0000-036596 unclaimed
High: Incorrect boundary conditions in the JavaScript Engine component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117947 BR2026-0000-036597 unclaimed
High: Use-after-free in the XML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117948 BR2026-0000-036598 unclaimed
High: Use-after-free in the SVG component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117949 BR2026-0000-036599 unclaimed
High: Use-after-free in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)
CVE-2026-117950 BR2026-0000-036600 unclaimed
High: Incorrect boundary conditions in the DOM: Core & HTML component
Credited as OpenAI Codex Security (kylebot)