# thunderbird 1:140.7.1+build1-0ubuntu0.22.04.1: thunderbird 1:140.7.1+build1-0ubuntu0.22.04.1 for Ubuntu 22.04.1 LTS (jammy)

thunderbird 1:140.7.1+build1-0ubuntu0.22.04.1, released January 28, 2026, fixes 112 CVEs in thunderbird. None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/ubuntu-jammy-thunderbird-1-140.7.1-build1-0ubuntu0.22.04.1
- Platform: Linux
- Released: Jan 28, 2026
- Priority: Urgent (Closes CVE-2025-8028, rated Critical)
- CVEs: 112, exploited: 0, on CISA KEV: 0

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [thunderbird](https://patchblox.com/security/data/product/linux/thunderbird.md) | Ubuntu 22.04.1 LTS (jammy) | 1:140.7.1+build1-0ubuntu0.22.04.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-8028](https://patchblox.com/security/data/cve/CVE-2025-8028.md) | Urgent | Large branch table could lead to truncated instruction | 9.8 | 0.0058 |  |
| [CVE-2025-8031](https://patchblox.com/security/data/cve/CVE-2025-8031.md) | Urgent | Incorrect URL stripping in CSP reports | 9.8 | 0.0051 |  |
| [CVE-2025-8034](https://patchblox.com/security/data/cve/CVE-2025-8034.md) | Urgent | Memory safety bugs fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0046 |  |
| [CVE-2025-8027](https://patchblox.com/security/data/cve/CVE-2025-8027.md) | Urgent | JavaScript engine only wrote partial return value to stack | 7.5 | 0.0043 |  |
| [CVE-2025-8033](https://patchblox.com/security/data/cve/CVE-2025-8033.md) | Urgent | Incorrect JavaScript state machine for generators | 7.5 | 0.0043 |  |
| [CVE-2025-0247](https://patchblox.com/security/data/cve/CVE-2025-0247.md) | High | Memory safety bugs fixed in Firefox 134 and Thunderbird 134 | 9.8 | 0.1070 |  |
| [CVE-2025-6436](https://patchblox.com/security/data/cve/CVE-2025-6436.md) | High | Memory safety bugs fixed in Firefox 140 and Thunderbird 140 | 8.1 | 0.0426 |  |
| [CVE-2024-10466](https://patchblox.com/security/data/cve/CVE-2024-10466.md) | High | Mozilla Firefox ESR and 7 others: Uncontrolled Resource Consumption | 7.5 | 0.0081 |  |
| [CVE-2025-10533](https://patchblox.com/security/data/cve/CVE-2025-10533.md) | High | Integer overflow in the SVG component | 8.8 | 0.0077 |  |
| [CVE-2025-0241](https://patchblox.com/security/data/cve/CVE-2025-0241.md) | High | Memory corruption when using JavaScript Text Segmentation | 7.7 | 0.0073 |  |
| [CVE-2025-9179](https://patchblox.com/security/data/cve/CVE-2025-9179.md) | High | Sandbox escape due to invalid pointer in the Audio/Video: GMP component | 9.8 | 0.0065 |  |
| [CVE-2025-5283](https://patchblox.com/security/data/cve/CVE-2025-5283.md) | High | Chromium: CVE-2025-5283 Use after free in libvpx | 8.8 | 0.0064 |  |
| [CVE-2025-14321](https://patchblox.com/security/data/cve/CVE-2025-14321.md) | High | Use-after-free in the WebRTC: Signaling component | 9.8 | 0.0064 |  |
| [CVE-2024-10467](https://patchblox.com/security/data/cve/CVE-2024-10467.md) | High | Mozilla Firefox ESR and 7 others: Out-of-bounds Read | 8.8 | 0.0063 |  |
| [CVE-2024-9402](https://patchblox.com/security/data/cve/CVE-2024-9402.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 9.8 | 0.0062 |  |
| [CVE-2025-14324](https://patchblox.com/security/data/cve/CVE-2025-14324.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0061 |  |
| [CVE-2024-9396](https://patchblox.com/security/data/cve/CVE-2024-9396.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.8 | 0.0059 |  |
| [CVE-2026-0880](https://patchblox.com/security/data/cve/CVE-2026-0880.md) | High | Sandbox escape due to integer overflow in the Graphics component | 8.8 | 0.0054 |  |
| [CVE-2025-14330](https://patchblox.com/security/data/cve/CVE-2025-14330.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 9.8 | 0.0054 |  |
| [CVE-2025-1020](https://patchblox.com/security/data/cve/CVE-2025-1020.md) | High | Memory safety bugs fixed in Firefox 135 and Thunderbird 135 | 9.8 | 0.0054 |  |
| [CVE-2025-9185](https://patchblox.com/security/data/cve/CVE-2025-9185.md) | High | Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 | 8.1 | 0.0054 |  |
| [CVE-2025-11708](https://patchblox.com/security/data/cve/CVE-2025-11708.md) | High | Use-after-free in MediaTrackGraphImpl::GetInstance() | 9.8 | 0.0051 |  |
| [CVE-2024-9400](https://patchblox.com/security/data/cve/CVE-2024-9400.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 8.8 | 0.0051 |  |
| [CVE-2026-0879](https://patchblox.com/security/data/cve/CVE-2026-0879.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics component | 9.8 | 0.0050 |  |
| [CVE-2024-9399](https://patchblox.com/security/data/cve/CVE-2024-9399.md) | High | Mozilla Firefox ESR and 7 others: Improper Resource Shutdown or Release | 7.5 | 0.0050 |  |
| [CVE-2025-1942](https://patchblox.com/security/data/cve/CVE-2025-1942.md) | High | Disclosure of uninitialized memory when .toUpperCase() causes string to get longer | 9.8 | 0.0048 |  |
| [CVE-2025-3034](https://patchblox.com/security/data/cve/CVE-2025-3034.md) | High | Memory safety bugs fixed in Firefox 137 and Thunderbird 137 | 8.1 | 0.0048 |  |
| [CVE-2026-0891](https://patchblox.com/security/data/cve/CVE-2026-0891.md) | High | Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147 | 8.1 | 0.0048 |  |
| [CVE-2025-14333](https://patchblox.com/security/data/cve/CVE-2025-14333.md) | High | Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 | 8.1 | 0.0047 |  |
| [CVE-2026-0877](https://patchblox.com/security/data/cve/CVE-2026-0877.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0047 |  |
| [CVE-2026-0878](https://patchblox.com/security/data/cve/CVE-2026-0878.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.0 | 0.0047 |  |
| [CVE-2026-0882](https://patchblox.com/security/data/cve/CVE-2026-0882.md) | High | Use-after-free in the IPC component | 8.8 | 0.0047 |  |
| [CVE-2026-0884](https://patchblox.com/security/data/cve/CVE-2026-0884.md) | High | Use-after-free in the JavaScript Engine component | 9.8 | 0.0046 |  |
| [CVE-2025-6435](https://patchblox.com/security/data/cve/CVE-2025-6435.md) | High | Save as in Devtools could download files without sanitizing the extension | 8.1 | 0.0046 |  |
| [CVE-2024-9403](https://patchblox.com/security/data/cve/CVE-2024-9403.md) | High | Mozilla Firefox ESR and 7 others: Improper Restriction of Operations within the Bounds of a Memory Buffer | 7.5 | 0.0045 |  |
| [CVE-2025-8036](https://patchblox.com/security/data/cve/CVE-2025-8036.md) | High | DNS rebinding circumvents CORS | 8.1 | 0.0045 |  |
| [CVE-2025-14323](https://patchblox.com/security/data/cve/CVE-2025-14323.md) | High | Privilege escalation in the DOM: Notifications component | 8.8 | 0.0045 |  |
| [CVE-2025-1943](https://patchblox.com/security/data/cve/CVE-2025-1943.md) | High | Memory safety bugs fixed in Firefox 136 and Thunderbird 136 | 8.2 | 0.0044 |  |
| [CVE-2025-9182](https://patchblox.com/security/data/cve/CVE-2025-9182.md) | High | Denial-of-service due to out-of-memory in the Graphics: WebRender component | 7.5 | 0.0044 |  |
| [CVE-2025-14328](https://patchblox.com/security/data/cve/CVE-2025-14328.md) | High | Privilege escalation in the Netmonitor component | 8.8 | 0.0043 |  |
| [CVE-2025-14329](https://patchblox.com/security/data/cve/CVE-2025-14329.md) | High | Privilege escalation in the Netmonitor component | 8.8 | 0.0043 |  |
| [CVE-2025-11709](https://patchblox.com/security/data/cve/CVE-2025-11709.md) | High | Out of bounds read/write in a privileged process triggered by WebGL textures | 9.8 | 0.0042 |  |
| [CVE-2025-11710](https://patchblox.com/security/data/cve/CVE-2025-11710.md) | High | Cross-process information leaked due to malicious IPC messages | 9.8 | 0.0042 |  |
| [CVE-2025-9184](https://patchblox.com/security/data/cve/CVE-2025-9184.md) | High | Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 | 8.1 | 0.0042 |  |
| [CVE-2025-9181](https://patchblox.com/security/data/cve/CVE-2025-9181.md) | High | Uninitialized memory in the JavaScript Engine component | 7.5 | 0.0041 |  |
| [CVE-2025-13016](https://patchblox.com/security/data/cve/CVE-2025-13016.md) | High | Incorrect boundary conditions in the JavaScript: WebAssembly component | 7.5 | 0.0041 |  |
| [CVE-2025-14327](https://patchblox.com/security/data/cve/CVE-2025-14327.md) | High | Spoofing issue in the Downloads Panel component | 7.5 | 0.0041 |  |
| [CVE-2025-3032](https://patchblox.com/security/data/cve/CVE-2025-3032.md) | High | Leaking file descriptors from the fork server | 7.4 | 0.0041 |  |
| [CVE-2026-0885](https://patchblox.com/security/data/cve/CVE-2026-0885.md) | High | Use-after-free in the JavaScript: GC component | 7.5 | 0.0040 |  |
| [CVE-2025-8035](https://patchblox.com/security/data/cve/CVE-2025-8035.md) | High | Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0040 |  |
| [CVE-2026-0886](https://patchblox.com/security/data/cve/CVE-2026-0886.md) | High | Incorrect boundary conditions in the Graphics component | 7.5 | 0.0038 |  |
| [CVE-2025-8029](https://patchblox.com/security/data/cve/CVE-2025-8029.md) | High | javascript: URLs executed on object and embed tags | 8.1 | 0.0038 |  |
| [CVE-2025-8030](https://patchblox.com/security/data/cve/CVE-2025-8030.md) | High | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0038 |  |
| [CVE-2025-8032](https://patchblox.com/security/data/cve/CVE-2025-8032.md) | High | XSLT documents could bypass CSP | 8.1 | 0.0038 |  |
| [CVE-2025-10528](https://patchblox.com/security/data/cve/CVE-2025-10528.md) | High | Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component | 7.5 | 0.0037 |  |
| [CVE-2025-6427](https://patchblox.com/security/data/cve/CVE-2025-6427.md) | High | connect-src Content Security Policy restriction could be bypassed | 9.1 | 0.0037 |  |
| [CVE-2025-8040](https://patchblox.com/security/data/cve/CVE-2025-8040.md) | High | Memory safety bugs fixed in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141 | 8.8 | 0.0037 |  |
| [CVE-2025-14325](https://patchblox.com/security/data/cve/CVE-2025-14325.md) | High | JIT miscompilation in the JavaScript Engine: JIT component | 7.5 | 0.0037 |  |
| [CVE-2025-14322](https://patchblox.com/security/data/cve/CVE-2025-14322.md) | High | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component | 8.0 | 0.0036 |  |
| [CVE-2026-0883](https://patchblox.com/security/data/cve/CVE-2026-0883.md) | High | Information disclosure in the Networking component | 7.5 | 0.0036 |  |
| [CVE-2025-6432](https://patchblox.com/security/data/cve/CVE-2025-6432.md) | High | DNS Requests leaked outside of a configured SOCKS proxy | 8.6 | 0.0035 |  |
| [CVE-2025-5272](https://patchblox.com/security/data/cve/CVE-2025-5272.md) | High | Memory safety bugs fixed in Firefox 139 and Thunderbird 139 | 7.3 | 0.0034 |  |
| [CVE-2025-8039](https://patchblox.com/security/data/cve/CVE-2025-8039.md) | High | Search terms persisted in URL bar | 8.1 | 0.0034 |  |
| [CVE-2025-10537](https://patchblox.com/security/data/cve/CVE-2025-10537.md) | High | Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 | 8.8 | 0.0034 |  |
| [CVE-2025-11714](https://patchblox.com/security/data/cve/CVE-2025-11714.md) | High | Memory safety bugs fixed in Firefox ESR 115.29, Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0033 |  |
| [CVE-2026-0887](https://patchblox.com/security/data/cve/CVE-2026-0887.md) | High | Clickjacking issue, information disclosure in the PDF Viewer component | 7.5 | 0.0033 |  |
| [CVE-2025-11715](https://patchblox.com/security/data/cve/CVE-2025-11715.md) | High | Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 | 8.8 | 0.0033 |  |
| [CVE-2025-10532](https://patchblox.com/security/data/cve/CVE-2025-10532.md) | High | Incorrect boundary conditions in the JavaScript: GC component | 7.5 | 0.0033 |  |
| [CVE-2025-13014](https://patchblox.com/security/data/cve/CVE-2025-13014.md) | High | Use-after-free in the Audio/Video component | 8.8 | 0.0032 |  |
| [CVE-2025-10529](https://patchblox.com/security/data/cve/CVE-2025-10529.md) | High | Same-origin policy bypass in the Layout component | 7.5 | 0.0031 |  |
| [CVE-2025-4085](https://patchblox.com/security/data/cve/CVE-2025-4085.md) | High | Potential information leakage and privilege escalation in UITour actor | 7.1 | 0.0031 |  |
| [CVE-2025-13020](https://patchblox.com/security/data/cve/CVE-2025-13020.md) | High | Use-after-free in the WebRTC: Audio/Video component | 8.8 | 0.0031 |  |
| [CVE-2026-0890](https://patchblox.com/security/data/cve/CVE-2026-0890.md) | High | Spoofing issue in the DOM: Copy & Paste and Drag & Drop component | 7.5 | 0.0030 |  |
| [CVE-2025-6433](https://patchblox.com/security/data/cve/CVE-2025-6433.md) | High | WebAuthn would allow a user to sign a challenge on a webpage with an invalid TLS certificate | 9.8 | 0.0030 |  |
| [CVE-2025-10527](https://patchblox.com/security/data/cve/CVE-2025-10527.md) | High | Sandbox escape due to use-after-free in the Graphics: Canvas2D component | 7.5 | 0.0029 |  |
| [CVE-2025-5270](https://patchblox.com/security/data/cve/CVE-2025-5270.md) | High | SNI was sometimes unencrypted | 7.5 | 0.0029 |  |
| [CVE-2025-11713](https://patchblox.com/security/data/cve/CVE-2025-11713.md) | High | Potential user-assisted code execution in “Copy as cURL” command | 8.1 | 0.0029 |  |
| [CVE-2025-9180](https://patchblox.com/security/data/cve/CVE-2025-9180.md) | High | Same-origin policy bypass in the Graphics: Canvas2D component | 8.1 | 0.0028 |  |
| [CVE-2025-13017](https://patchblox.com/security/data/cve/CVE-2025-13017.md) | High | Same-origin policy bypass in the DOM: Notifications component | 8.1 | 0.0028 |  |
| [CVE-2025-13018](https://patchblox.com/security/data/cve/CVE-2025-13018.md) | High | Mitigation bypass in the DOM: Security component | 8.1 | 0.0028 |  |
| [CVE-2025-13019](https://patchblox.com/security/data/cve/CVE-2025-13019.md) | High | Same-origin policy bypass in the DOM: Workers component | 8.1 | 0.0028 |  |
| [CVE-2025-8038](https://patchblox.com/security/data/cve/CVE-2025-8038.md) | High | CSP frame-src was not correctly enforced for paths | 9.8 | 0.0027 |  |
| [CVE-2025-8037](https://patchblox.com/security/data/cve/CVE-2025-8037.md) | High | Nameless cookies shadow secure cookies | 9.1 | 0.0027 |  |
| [CVE-2025-0243](https://patchblox.com/security/data/cve/CVE-2025-0243.md) | High | Memory safety bugs fixed in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6 | 7.5 | 0.0025 |  |
| [CVE-2025-13012](https://patchblox.com/security/data/cve/CVE-2025-13012.md) | High | Race condition in the Graphics component | 7.5 | 0.0024 |  |
| [CVE-2025-11711](https://patchblox.com/security/data/cve/CVE-2025-11711.md) | High | Some non-writable Object properties could be modified | 7.5 | 0.0023 |  |
| [CVE-2025-13015](https://patchblox.com/security/data/cve/CVE-2025-13015.md) | High | Spoofing issue in Firefox | 7.5 | 0.0023 |  |
| [CVE-2025-11712](https://patchblox.com/security/data/cve/CVE-2025-11712.md) | High | An OBJECT tag type attribute overrode browser behavior on web resources without a content-type | 7.5 | 0.0022 |  |
| [CVE-2025-13013](https://patchblox.com/security/data/cve/CVE-2025-13013.md) | High | Mitigation bypass in the DOM: Core & HTML component | 7.5 | 0.0022 |  |
| [CVE-2025-14331](https://patchblox.com/security/data/cve/CVE-2025-14331.md) | High | Same-origin policy bypass in the Request Handling component | 7.5 | 0.0020 |  |
| [CVE-2025-10536](https://patchblox.com/security/data/cve/CVE-2025-10536.md) | High | Information disclosure in the Networking: Cache component | 7.5 | 0.0017 |  |
| [CVE-2024-50336](https://patchblox.com/security/data/cve/CVE-2024-50336.md) | Routine | MozillaThunderbird: Fixed insufficient MXC URI validation which could allow client-side path traversal (bsc#1234413) | n/a | 0.0083 |  |
| [CVE-2025-0240](https://patchblox.com/security/data/cve/CVE-2025-0240.md) | Routine | Compartment mismatch when parsing JavaScript JSON module | 6.5 | 0.0067 |  |
| [CVE-2024-10464](https://patchblox.com/security/data/cve/CVE-2024-10464.md) | Routine | Mozilla Firefox ESR and 7 others: Out-of-bounds Read | 6.5 | 0.0064 |  |
| [CVE-2024-10461](https://patchblox.com/security/data/cve/CVE-2024-10461.md) | Routine | Mozilla Firefox ESR and 7 others: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 6.1 | 0.0060 |  |
| [CVE-2025-0237](https://patchblox.com/security/data/cve/CVE-2025-0237.md) | Routine | WebChannel APIs susceptible to confused deputy attack | 6.8 | 0.0060 |  |
| [CVE-2024-9398](https://patchblox.com/security/data/cve/CVE-2024-9398.md) | Routine | Mozilla Firefox ESR and 7 others: Observable Discrepancy | 5.3 | 0.0057 |  |
| [CVE-2024-10462](https://patchblox.com/security/data/cve/CVE-2024-10462.md) | Routine | Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing | 6.5 | 0.0057 |  |
| [CVE-2024-10465](https://patchblox.com/security/data/cve/CVE-2024-10465.md) | Routine | Mozilla Firefox ESR and 7 others: Authentication Bypass by Spoofing | 6.5 | 0.0057 |  |
| [CVE-2024-10468](https://patchblox.com/security/data/cve/CVE-2024-10468.md) | Routine | Mozilla Firefox ESR and 7 others: Allocation of Resources Without Limits or Throttling | 5.3 | 0.0042 |  |
| [CVE-2025-1018](https://patchblox.com/security/data/cve/CVE-2025-1018.md) | Routine | Fullscreen notification is not displayed when fullscreen is re-requested | 5.3 | 0.0041 |  |
| [CVE-2024-9397](https://patchblox.com/security/data/cve/CVE-2024-9397.md) | Routine | Mozilla Firefox ESR and 7 others: Improper Restriction of Rendered UI Layers or Frames | 6.1 | 0.0037 |  |
| [CVE-2025-1019](https://patchblox.com/security/data/cve/CVE-2025-1019.md) | Routine | Fullscreen notification not properly displayed | 4.3 | 0.0036 |  |
| [CVE-2024-10460](https://patchblox.com/security/data/cve/CVE-2024-10460.md) | Routine | Mozilla Firefox ESR and 7 others: Origin Validation Error | 5.3 | 0.0034 |  |
| [CVE-2025-4092](https://patchblox.com/security/data/cve/CVE-2025-4092.md) | Routine | Memory safety bugs fixed in Firefox 138 and Thunderbird 138 | 6.5 | 0.0031 |  |
| [CVE-2025-5271](https://patchblox.com/security/data/cve/CVE-2025-5271.md) | Routine | Devtools' preview ignored CSP headers | 6.5 | 0.0031 |  |
| [CVE-2025-3031](https://patchblox.com/security/data/cve/CVE-2025-3031.md) | Routine | JIT optimization bug with different stack slot sizes | 6.5 | 0.0031 |  |
| [CVE-2025-6434](https://patchblox.com/security/data/cve/CVE-2025-6434.md) | Routine | HTTPS-Only exception screen lacked anti-clickjacking delay | 4.3 | 0.0028 |  |
| [CVE-2025-0239](https://patchblox.com/security/data/cve/CVE-2025-0239.md) | Routine | Alt-Svc ALPN validation failure when redirected | 5.4 | 0.0023 |  |
| [CVE-2025-4089](https://patchblox.com/security/data/cve/CVE-2025-4089.md) | Routine | Potential local code execution in "copy as cURL" command | 5.1 | 0.0019 |  |
| [CVE-2025-4088](https://patchblox.com/security/data/cve/CVE-2025-4088.md) | Routine | Cross-site request forgery via storage access API redirects | 6.5 | 0.0018 |  |
| [CVE-2026-0818](https://patchblox.com/security/data/cve/CVE-2026-0818.md) | Routine | CSS-based exfiltration of the content from partially encrypted emails when allowing remote content | 4.3 | 0.0018 |  |

---

Data as of 2026-11-14T14:09:31Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.