CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 12:00 AM ET)

What this means for you

This week: 3,093 CVEs published, 234 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,093; Show in the list
Critical, last 7 days: 234; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product mozilla:thunderbird. Show all products

928 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2010-3765 Known exploited	Critical 9.8	Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10, when JavaScript is enabled, allows remote attac… Assigned by mitre	Oct 27, 2010
CVE-2013-1675 Known exploited	Medium 6.5	Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mP… Assigned by mozilla	May 16, 2013
CVE-2013-1690 Known exploited	High 8.8	Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with pag… Assigned by mozilla	Jun 25, 2013
CVE-2016-9079 Known exploited	High 7.5	A use-after-free vulnerability in SVG Animation has been discovered. Assigned by mozilla	Jun 11, 2018
CVE-2017-5436	High 8.8	An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font.	Jun 11, 2018
CVE-2019-11708 Known exploited	Critical 10.0	Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent process opening web content chosen by a compromise… Assigned by mozilla	Jul 23, 2019
CVE-2019-11707 Known exploited	High 8.8	A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. Assigned by mozilla	Jul 23, 2019
CVE-2019-17026 Known exploited	High 8.8	Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. Assigned by mozilla	Mar 1, 2020
CVE-2020-6820 Known exploited	High 8.1	Under certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. Assigned by mozilla	Apr 24, 2020
CVE-2020-6819 Known exploited	High 8.1	Under certain conditions, when running the nsDocShell destructor, a race condition can cause a use-after-free. Assigned by mozilla	Apr 24, 2020

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.