All apps
T
Thunderbird
CommunicationFree email, calendar, and chat client — release and ESR channels
Latest versions
Stable
WindowsLinuxmacOS
158.0Enterprise Stable
WindowsmacOSLinux
153.5.0esrActively exploited
0
CISA KEV · 14 lifetime
Affecting latest
0
v158.0
+14 unverified
Known CVEs
2068
across all versions, as matched by PemSync
Last checked
21 Oct 2026, 4:42
Of 2068 recorded CVEs, 2054 are fixed in versions you're past. 14 could not be evaluated against 158.0 — treat them as unknown rather than resolved. They are listed first in the table below.
These verdicts were computed against 158.0 only. We also track Enterprise Stable 153.5.0esr, which was not evaluated — a CVE fixed in 158.0 may still affect that build.
| CVE | Severity | EPSS pct | Status | Score source | |
|---|---|---|---|---|---|
| — | 95% | Impact unverified | — | 4 Feb 2019 | |
| — | 91% | Impact unverified | — | 16 May 2018 | |
| — | 93% | Impact unverified | — | 16 May 2018 | |
| — | 63% | Impact unverified | — | 29 Jan 2010 | |
| — | 82% | Impact unverified | — | 17 Dec 2009 | |
| — | 82% | Impact unverified | — | 17 Dec 2009 | |
| — | 90% | Impact unverified | — | 17 Dec 2009 | |
| — | 90% | Impact unverified | — | 17 Dec 2009 | |
| — | 90% | Impact unverified | — | 17 Dec 2009 | |
| — | 82% | Impact unverified | — | 12 Jun 2009 | |
| — | 71% | Impact unverified | — | 22 Apr 2009 | |
| — | 83% | Impact unverified | — | 22 Apr 2009 | |
| — | 82% | Impact unverified | — | 22 Apr 2009 | |
| — | 71% | Impact unverified | — | 22 Apr 2009 | |
CVE-2024-9680Exploited | CRITICAL 9.8 | 98% | Latest not affected | NVD | 9 Oct 2024 |
CVE-2023-5217Exploited | HIGH 8.8 | 99% | Latest not affected | NVD | 28 Sep 2023 |
CVE-2023-4863Exploited | HIGH 8.8 | 100% | Latest not affected | NVD | 12 Sep 2023 |
CVE-2022-26486Exploited | CRITICAL 9.6 | 83% | Latest not affected | NVD | 22 Dec 2022 |
CVE-2022-26485Exploited | HIGH 8.8 | 97% | Latest not affected | NVD | 22 Dec 2022 |
CVE-2020-6820Exploited | HIGH 8.1 | 94% | Latest not affected | NVD | 24 Apr 2020 |
CVE-2020-6819Exploited | HIGH 8.1 | 87% | Latest not affected | NVD | 24 Apr 2020 |
CVE-2019-17026Exploited | HIGH 8.8 | 99% | Latest not affected | NVD | 2 Mar 2020 |
CVE-2019-11708Exploited | CRITICAL 10.0 | 99% | Latest not affected | NVD | 23 Jul 2019 |
CVE-2019-11707Exploited | HIGH 8.8 | 99% | Latest not affected | NVD | 23 Jul 2019 |
CVE-2016-9079Exploited | HIGH 7.5 | 100% | Latest not affected | NVD | 11 Jun 2018 |
Showing 1–25 of 2068
Page 1 of 83
PemSync reports known, cataloged exploited vulnerabilities (CISA KEV) and published CVEs. It is not a zero-day detection or threat-intelligence system — a vulnerability may be exploited before it appears here. Absence of data does not mean an app is secure.