CVE-2026-118179

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

• https://bugzilla.mozilla.org/show_bug.cgi?id=2077789
• https://www.mozilla.org/security/advisories/mfsa2026-121/
• https://www.mozilla.org/security/advisories/mfsa2026-122/

Published

Oct 27, 2026

Last Modified

Oct 28, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118173MISP Guard, a proxy that enforces security policies on MISP …6.1
• CVE-2026-118174When a message containing an OpenPGP key attachment was disp…
• CVE-2026-118175When replying to, forwarding, or editing a crafted email mes…
• CVE-2026-118176Thunderbird's check that prevents mailbox: URLs from accessi…
• CVE-2026-118177When looking for calendars in a directory on a server, durin…
• CVE-2026-118178A remote RSS feed could use the itunes:new-feed-url or newLo…
• CVE-2026-11818The WPCafe – Restaurant Menu, Online Food Ordering & Table B…5.4
• CVE-2026-118180When logging in to a Matrix account, Thunderbird used the ho…
• CVE-2026-11819Module: plugins/modules/keyring_info.py CVSS 3.1: 5.5 MEDI…5.5
• CVE-2026-118192The JoomSport – for Sports: Team & League, Football, Hockey …6.5
• CVE-2026-118194The Page and Post Restriction plugin for WordPress is vulner…6.5
• CVE-2026-1182GitLab has remediated an issue in GitLab CE/EE affecting all…4.3