CVE-2026-84642

CVE-2026-84642 affects Mozilla Thunderbird , where the mail.allowed_attachment_hostnames advanced config setting values were inserted into a regular expression without escaping . For certain valid hostnames, this regex injection allowed unintended hostnames to match , enabling remote attachments ...

CVE-2026-84637

CVE-2026-84637 is a critical (CVSS 9.8) vulnerability in Mozilla Thunderbird where malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows , bypassing Thunderbird's normal executable attachment protections. With the new invitation dis...

CVE-2026-84118

CVE-2026-84118 is a use-after-free vulnerability in the JavaScript GC (Garbage Collector) component of Mozilla Firefox . The flaw can lead to low confidentiality and integrity impact when a user interacts with a crafted page, but does not affect availability (CVSS 3.1 score: 5.4 MEDIUM , vector A...

CVE-2026-84641

A use-after-free in Mozilla Thunderbird's IMAP ID response handling allows a malicious IMAP server to trigger heap-memory disclosure. The leaked heap contents can ultimately be persisted to prefs.js , enabling an attacker to recover sensitive data without user interaction. The vulnerability carri...

CVE-2026-84132

CVE-2026-84132 is an information disclosure vulnerability in the Networking: HTTP component of Mozilla's Firefox and Thunderbird products. A remote attacker with no privileges and no user interaction can obtain sensitive information, resulting in high confidentiality impact with no integrity or a...