RHSA-2026:49621
Vulnerability from csaf_opensuse - Published: 2026-08-03 00:00 - Updated: 2026-09-16 18:42Summary
security update for thunderbird
Severity
Important
Notes
Title of the patch: security update for thunderbird
Description of the patch: This security update provides a functional equivalent of RHSA-2026:49621.
The original Red Hat(R) advisory is available from the Red Hat web site at
https://access.redhat.com/errata/RHSA-2026:49621.
Patchnames: RHSA-2026:49621
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.5 (High)
Affected products
Recommended
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
moderate
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
moderate
7.4 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
8.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
8.3 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
8.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
7.8 (High)
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
Affected products
Recommended
1 product, the same list as for
CVE-2026-14899
Threats
Impact
important
References
103 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "security update for thunderbird",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This security update provides a functional equivalent of RHSA-2026:49621.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2026:49621.\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "RHSA-2026:49621",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_49621.json"
},
{
"category": "self",
"summary": "URL for RHSA-2026:49621",
"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007311.html"
},
{
"category": "self",
"summary": "E-Mail link for RHSA-2026:49621",
"url": "https://lists.suse.com/pipermail/suse-liberty-linux-updates/2026-August/007311.html"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-14899 page",
"url": "https://www.suse.com/security/cve/CVE-2026-14899/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-15718 page",
"url": "https://www.suse.com/security/cve/CVE-2026-15718/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-15719 page",
"url": "https://www.suse.com/security/cve/CVE-2026-15719/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16349 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16349/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16350 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16350/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16351 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16351/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16352 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16352/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16353 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16353/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16354 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16354/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16355 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16355/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16356 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16356/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16357 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16357/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16358 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16358/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16359 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16359/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16360 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16360/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16361 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16361/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16362 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16362/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16363 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16363/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16368 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16368/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16369 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16369/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16371 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16371/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16374 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16375 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16375/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16377 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16379 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16379/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16381 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16381/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16383 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16383/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16387 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16387/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16390 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16390/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16391 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16391/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16396 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16396/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16405 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16405/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-16412 page",
"url": "https://www.suse.com/security/cve/CVE-2026-16412/"
}
],
"title": "security update for thunderbird",
"tracking": {
"current_release_date": "2026-09-16T18:42:00Z",
"generator": {
"date": "2026-08-03T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "RHSA-2026:49621",
"initial_release_date": "2026-08-03T00:00:00Z",
"revision_history": [
{
"date": "2026-08-03T00:00:00Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-16T18:00:38Z",
"number": "2",
"summary": "unknown changes"
},
{
"date": "2026-09-16T18:42:00Z",
"number": "3",
"summary": "unknown changes"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "thunderbird-140.13.0-1.el10_2.x86_64",
"product": {
"name": "thunderbird-140.13.0-1.el10_2.x86_64",
"product_id": "thunderbird-140.13.0-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/suse/thunderbird@140.13.0-1.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Liberty Linux 10",
"product": {
"name": "SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sll:10"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "thunderbird-140.13.0-1.el10_2.x86_64 as component of SUSE Liberty Linux 10",
"product_id": "SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
},
"product_reference": "thunderbird-140.13.0-1.el10_2.x86_64",
"relates_to_product_reference": "SUSE Liberty Linux 10"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-14899",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-14899"
}
],
"notes": [
{
"category": "general",
"text": "The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-14899",
"url": "https://www.suse.com/security/cve/CVE-2026-14899"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-14899",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-14899"
},
{
"cve": "CVE-2026-15718",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-15718"
}
],
"notes": [
{
"category": "general",
"text": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-15718",
"url": "https://www.suse.com/security/cve/CVE-2026-15718"
},
{
"category": "external",
"summary": "SUSE Bug 1271403 for CVE-2026-15718",
"url": "https://bugzilla.suse.com/1271403"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-15718"
},
{
"cve": "CVE-2026-15719",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-15719"
}
],
"notes": [
{
"category": "general",
"text": "We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-15719",
"url": "https://www.suse.com/security/cve/CVE-2026-15719"
},
{
"category": "external",
"summary": "SUSE Bug 1271403 for CVE-2026-15719",
"url": "https://bugzilla.suse.com/1271403"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-15719"
},
{
"cve": "CVE-2026-16349",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16349"
}
],
"notes": [
{
"category": "general",
"text": "Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16349",
"url": "https://www.suse.com/security/cve/CVE-2026-16349"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16349",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16349"
},
{
"cve": "CVE-2026-16350",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16350"
}
],
"notes": [
{
"category": "general",
"text": "Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16350",
"url": "https://www.suse.com/security/cve/CVE-2026-16350"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16350",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16350"
},
{
"cve": "CVE-2026-16351",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16351"
}
],
"notes": [
{
"category": "general",
"text": "Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16351",
"url": "https://www.suse.com/security/cve/CVE-2026-16351"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16351",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16351"
},
{
"cve": "CVE-2026-16352",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16352"
}
],
"notes": [
{
"category": "general",
"text": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16352",
"url": "https://www.suse.com/security/cve/CVE-2026-16352"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16352",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16352"
},
{
"cve": "CVE-2026-16353",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16353"
}
],
"notes": [
{
"category": "general",
"text": "Invalid pointer in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16353",
"url": "https://www.suse.com/security/cve/CVE-2026-16353"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16353",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16353"
},
{
"cve": "CVE-2026-16354",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16354"
}
],
"notes": [
{
"category": "general",
"text": "Information disclosure in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16354",
"url": "https://www.suse.com/security/cve/CVE-2026-16354"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16354",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16354"
},
{
"cve": "CVE-2026-16355",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16355"
}
],
"notes": [
{
"category": "general",
"text": "JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16355",
"url": "https://www.suse.com/security/cve/CVE-2026-16355"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16355",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16355"
},
{
"cve": "CVE-2026-16356",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16356"
}
],
"notes": [
{
"category": "general",
"text": "Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16356",
"url": "https://www.suse.com/security/cve/CVE-2026-16356"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16356",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16356"
},
{
"cve": "CVE-2026-16357",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16357"
}
],
"notes": [
{
"category": "general",
"text": "Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16357",
"url": "https://www.suse.com/security/cve/CVE-2026-16357"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16357",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16357"
},
{
"cve": "CVE-2026-16358",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16358"
}
],
"notes": [
{
"category": "general",
"text": "Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16358",
"url": "https://www.suse.com/security/cve/CVE-2026-16358"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16358",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16358"
},
{
"cve": "CVE-2026-16359",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16359"
}
],
"notes": [
{
"category": "general",
"text": "Incorrect boundary conditions in the Audio/Video: GMP component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16359",
"url": "https://www.suse.com/security/cve/CVE-2026-16359"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16359",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16359"
},
{
"cve": "CVE-2026-16360",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16360"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox ESR 115.37, Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16360",
"url": "https://www.suse.com/security/cve/CVE-2026-16360"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16360",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16360"
},
{
"cve": "CVE-2026-16361",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16361"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Thunderbird ESR 140.12. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16361",
"url": "https://www.suse.com/security/cve/CVE-2026-16361"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16361",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16361"
},
{
"cve": "CVE-2026-16362",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16362"
}
],
"notes": [
{
"category": "general",
"text": "Use-after-free in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16362",
"url": "https://www.suse.com/security/cve/CVE-2026-16362"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16362",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16362"
},
{
"cve": "CVE-2026-16363",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16363"
}
],
"notes": [
{
"category": "general",
"text": "JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16363",
"url": "https://www.suse.com/security/cve/CVE-2026-16363"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16363",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16363"
},
{
"cve": "CVE-2026-16368",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16368"
}
],
"notes": [
{
"category": "general",
"text": "Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16368",
"url": "https://www.suse.com/security/cve/CVE-2026-16368"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16368",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16368"
},
{
"cve": "CVE-2026-16369",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16369"
}
],
"notes": [
{
"category": "general",
"text": "Integer overflow in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16369",
"url": "https://www.suse.com/security/cve/CVE-2026-16369"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16369",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16369"
},
{
"cve": "CVE-2026-16371",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16371"
}
],
"notes": [
{
"category": "general",
"text": "Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, Thunderbird 140.13, Firefox ESR 140.15, and Thunderbird 140.15.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16371",
"url": "https://www.suse.com/security/cve/CVE-2026-16371"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16371",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16371"
},
{
"cve": "CVE-2026-16374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16374"
}
],
"notes": [
{
"category": "general",
"text": "Information disclosure in the Framework component in DevTools. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16374",
"url": "https://www.suse.com/security/cve/CVE-2026-16374"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16374",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16374"
},
{
"cve": "CVE-2026-16375",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16375"
}
],
"notes": [
{
"category": "general",
"text": "Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16375",
"url": "https://www.suse.com/security/cve/CVE-2026-16375"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16375",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16375"
},
{
"cve": "CVE-2026-16377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16377"
}
],
"notes": [
{
"category": "general",
"text": "Mitigation bypass in the PDF Viewer component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16377",
"url": "https://www.suse.com/security/cve/CVE-2026-16377"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16377",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16377"
},
{
"cve": "CVE-2026-16379",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16379"
}
],
"notes": [
{
"category": "general",
"text": "Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16379",
"url": "https://www.suse.com/security/cve/CVE-2026-16379"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16379",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16379"
},
{
"cve": "CVE-2026-16381",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16381"
}
],
"notes": [
{
"category": "general",
"text": "Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16381",
"url": "https://www.suse.com/security/cve/CVE-2026-16381"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16381",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16381"
},
{
"cve": "CVE-2026-16383",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16383"
}
],
"notes": [
{
"category": "general",
"text": "Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16383",
"url": "https://www.suse.com/security/cve/CVE-2026-16383"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16383",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16383"
},
{
"cve": "CVE-2026-16387",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16387"
}
],
"notes": [
{
"category": "general",
"text": "Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16387",
"url": "https://www.suse.com/security/cve/CVE-2026-16387"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16387",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16387"
},
{
"cve": "CVE-2026-16390",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16390"
}
],
"notes": [
{
"category": "general",
"text": "Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16390",
"url": "https://www.suse.com/security/cve/CVE-2026-16390"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16390",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16390"
},
{
"cve": "CVE-2026-16391",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16391"
}
],
"notes": [
{
"category": "general",
"text": "Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16391",
"url": "https://www.suse.com/security/cve/CVE-2026-16391"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16391",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16391"
},
{
"cve": "CVE-2026-16396",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16396"
}
],
"notes": [
{
"category": "general",
"text": "Privilege escalation in WebExtensions. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16396",
"url": "https://www.suse.com/security/cve/CVE-2026-16396"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16396",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16396"
},
{
"cve": "CVE-2026-16405",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16405"
}
],
"notes": [
{
"category": "general",
"text": "Information disclosure in the Networking: WebSockets component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16405",
"url": "https://www.suse.com/security/cve/CVE-2026-16405"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16405",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16405"
},
{
"cve": "CVE-2026-16412",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-16412"
}
],
"notes": [
{
"category": "general",
"text": "Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-16412",
"url": "https://www.suse.com/security/cve/CVE-2026-16412"
},
{
"category": "external",
"summary": "SUSE Bug 1271649 for CVE-2026-16412",
"url": "https://bugzilla.suse.com/1271649"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Liberty Linux 10:thunderbird-140.13.0-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-08-03T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-16412"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…