Thunderbird

Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

Thunderbird

Product reference — Thunderbird by Mozilla · sector: Open Source Ecosystems. Cumulative disclosure record for this product across the archive.

Product totals

Disclosures & known-exploited
	All-time	YTD
CVEs	180	168
KEV entries	1	0

Rate & severity
KEV/100	Med CVSS	Med EPSS	C	H	M	L
0.6	8.8	.0028	63	63	35	0

KEV/100 = KEV entries ÷ CVEs × 100. Med CVSS / Med EPSS are medians over this product's disclosures. C/H/M/L = disclosures by CVSS severity band.

Monthly disclosures

Trend (by first-seen month, full archive): ▁▁▁▁▁▁▁▁▁▂▁▁▁▁▁▁▁▁▁▂▅█▇

Last 12 months (new CVEs by first-seen day)
Month	New CVEs
2025-09	1
2025-10	0
2025-11	0
2025-12	0
2026-01	0
2026-02	0
2026-03	0
2026-04	0
2026-05	5
2026-06	42
2026-07	66
2026-08	55

Notable CVEs

Ranked by the published formula: KEV → EPSS → CVSS → CVE ID.

Notable (ranked)
CVE	CVSS	EPSS %ile	Severity	KEV	First seen
CVE-2024-9680	9.8	97.6	CRITICAL	YES	2024-10-15
CVE-2026-74990	9.8	44.0	CRITICAL	—	2026-08-18
CVE-2026-8953	9.6	42.7	CRITICAL	—	2026-05-19
CVE-2026-12292	8.1	40.4	HIGH	—	2026-06-16
CVE-2026-12328	8.1	39.3	HIGH	—	2026-06-16
CVE-2025-8028	9.8	39.0	CRITICAL	—	2025-07-22
CVE-2026-8091	9.8	38.8	CRITICAL	—	2026-05-07
CVE-2026-8094	9.8	37.3	CRITICAL	—	2026-05-07
CVE-2026-16363	9.8	36.5	CRITICAL	—	2026-07-21
CVE-2026-16369	9.8	36.5	CRITICAL	—	2026-07-21
CVE-2026-16389	9.8	36.5	CRITICAL	—	2026-07-21
CVE-2025-8031	9.8	36.1	CRITICAL	—	2025-07-22
CVE-2026-75874	10.0	36.0	CRITICAL	—	2026-08-18
CVE-2025-4083	9.1	35.9	CRITICAL	—	2025-04-29
CVE-2025-8036	8.1	34.9	HIGH	—	2025-07-22

Recent CVEs

Most recently seen
CVE	CVSS	EPSS %ile	Severity	KEV	First seen
CVE-2026-74986	—	4.7	—	—	2026-08-18
CVE-2026-74989	—	4.7	—	—	2026-08-18
CVE-2026-74988	—	5.1	—	—	2026-08-18
CVE-2026-74981	—	4.7	—	—	2026-08-18
CVE-2026-74984	—	4.7	—	—	2026-08-18
CVE-2026-74982	—	4.7	—	—	2026-08-18
CVE-2026-74985	—	4.7	—	—	2026-08-18
CVE-2026-74978	8.1	16.3	HIGH	—	2026-08-18
CVE-2026-74979	9.8	27.9	CRITICAL	—	2026-08-18
CVE-2026-74977	7.5	26.6	HIGH	—	2026-08-18
CVE-2026-74973	4.2	8.7	MEDIUM	—	2026-08-18
CVE-2026-74966	—	4.1	—	—	2026-08-18
CVE-2026-74970	5.4	6.6	MEDIUM	—	2026-08-18
CVE-2026-74968	5.4	1.7	MEDIUM	—	2026-08-18
CVE-2026-74952	8.8	14.3	HIGH	—	2026-08-18

KEV entries

CISA Known Exploited Vulnerabilities (newest addition first)
CVE	KEV added	CVSS	EPSS %ile	Severity
CVE-2024-9680	2024-10-15	9.8	97.6	CRITICAL

Vendor: Mozilla — all products and the full vendor record.

Methodology

A product is a (vendor, product) pair as named in the affected-product data. Rate statistics are arithmetic over published figures. Counts key to first-seen day. Raw counts are not comparable across products; this is a reference page assembled from the public record, not a ranking by our judgment.