CVE-2026-5734

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 149.0.2, Firefox ESR 140.9.1, Thunderbird 149.0.2, and Thunderbird 140.9.1.

• CWE-787
• CWE-120
• CWE-787

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022369%2C2023026%2C2023545%2C2023555%2C2023958%2C2025422%2C2025468%2C2025492%2C2025505Broken Link, Issue Tracking
• https://www.mozilla.org/security/advisories/mfsa2026-25/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2026-27/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2026-28/
• https://www.mozilla.org/security/advisories/mfsa2026-29/
• https://access.redhat.com/errata/RHSA-2026:11805
• https://access.redhat.com/errata/RHSA-2026:11813
• https://access.redhat.com/errata/RHSA-2026:12264
• https://access.redhat.com/errata/RHSA-2026:13342
• https://access.redhat.com/errata/RHSA-2026:13412
• https://access.redhat.com/errata/RHSA-2026:13533
• https://access.redhat.com/errata/RHSA-2026:13582
• https://access.redhat.com/errata/RHSA-2026:13583
• https://access.redhat.com/errata/RHSA-2026:13596
• https://access.redhat.com/errata/RHSA-2026:13600
• https://access.redhat.com/errata/RHSA-2026:13665
• https://access.redhat.com/errata/RHSA-2026:13682
• https://access.redhat.com/errata/RHSA-2026:13683
• https://access.redhat.com/errata/RHSA-2026:13922
• https://access.redhat.com/errata/RHSA-2026:13977
• https://access.redhat.com/errata/RHSA-2026:14223
• https://access.redhat.com/errata/RHSA-2026:14303
• https://access.redhat.com/errata/RHSA-2026:15889
• https://access.redhat.com/errata/RHSA-2026:7671
• https://access.redhat.com/errata/RHSA-2026:7672
• https://access.redhat.com/errata/RHSA-2026:8052
• https://access.redhat.com/errata/RHSA-2026:8459
• https://access.redhat.com/errata/RHSA-2026:9345
• https://access.redhat.com/errata/RHSA-2026:9638
• https://access.redhat.com/security/cve/CVE-2026-5734
• https://bugzilla.redhat.com/show_bug.cgi?id=2455897
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5734.json

Published

Apr 7, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-57334Unauthenticated Broken Access Control in WP User Frontend <=…6.5
• CVE-2026-57335Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 …6.5
• CVE-2026-57336Unauthenticated Cross Site Scripting (XSS) in Jobify <= 4.3.…7.1
• CVE-2026-57337Unauthenticated Cross Site Scripting (XSS) in Landing Page B…7.1
• CVE-2026-57338Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1…7.1
• CVE-2026-57339Unauthenticated Broken Access Control in Business Directory …6.5
• CVE-2026-57340Unauthenticated Broken Access Control in Japanized For WooCo…6.5
• CVE-2026-57341Unauthenticated Insecure Direct Object References (IDOR) in …6.5
• CVE-2026-57342Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive…6.5
• CVE-2026-57343Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 …7.1
• CVE-2026-57344Unauthenticated Cross Site Scripting (XSS) in Classified Lis…7.1
• CVE-2026-57345Unauthenticated Cross Site Scripting (XSS) in Internal Links…7.1