CVE-2026-74989

Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154.

• CWE-119

• https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022257%2C2027351%2C2027380%2C2029289Not Applicable
• https://bugzilla.mozilla.org/buglist.cgi?bug_id=2027388%2C2029750%2C2029794%2C2043298%2C2045126%2C2049810%2C2051741Not Applicable
• https://www.mozilla.org/security/advisories/mfsa2026-74/Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2026-78/Vendor Advisory

Published

Aug 18, 2026

Last Modified

Oct 28, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-74983Mitigation bypass in the Data Loss Prevention component. Thi…8.1
• CVE-2026-74984Race condition in the JavaScript Engine component. This vuln…6.8
• CVE-2026-74985Privilege escalation in the Enterprise Policies component. T…9.8
• CVE-2026-74986Site isolation issue in the CSS Parsing and Computation comp…9.1
• CVE-2026-74987Internally found bugs present in Firefox ESR 140.13, Firefox…9.8
• CVE-2026-74988Internally found bugs present in Firefox ESR 153.0 and Firef…9.8
• CVE-2026-74990Internally found bugs present in Firefox ESR 115.38, Firefox…9.8
• CVE-2026-74991The WPForms WordPress plugin before 2.0.2 does not verify t…6.8
• CVE-2026-74992The Kirki WordPress plugin before 6.2.3 does not properly v…6.8
• CVE-2026-74993Improper neutralization of special elements used in an SQL c…7.5
• CVE-2026-74994The mod_auth module in OTP's inets httpd server, when config…6
• CVE-2026-74997In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, t…8.8