CVE-2026-6768: Authentication Bypass Using an Alternate Path or Channel

Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-6756: Exposure of Sensitive Information to an Unauthorized Actor

Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150...

CVE-2026-6774: Protection Mechanism Failure

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

PT-2026-33946

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Description A mitigation bypass exists in the Networking: Cookies component. Recommendations Update to version 150 for Firefox. Update to version 150 for Thunderbird...

PT-2026-33954

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Description A mitigation bypass exists in the Networking: Cookies component. Recommendations Update Firefox to version 150. Update Thunderbird to version 150...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=2025067 reports: Mitigation bypass in the DOM: Security component...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=2023615 reports: Mitigation bypass in the Networking: Cookies component...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=2016923 reports: Mitigation bypass in the Networking: Cookies component...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=2016915 reports: Mitigation bypass in the DOM: Security component...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=2021666 reports: Mitigation bypass in the File Handling component...

PT-2026-33957

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Firefox ESR versions prior to 140.10 Thunderbird versions prior to 150 Thunderbird versions prior to 140.10 Description A mitigation bypass exists within the DOM Security component. Recommendations Update to versi...

Mozilla -- Mitigation bypass

https://bugzilla.mozilla.org/showbug.cgi?id=1880429 reports: Mitigation bypass in the DOM: postMessage component...

PT-2026-33942

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 150 Description A mitigation bypass exists in the software. Recommendations Update to version 150...

PT-2026-33941

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Description A mitigation bypass exists in the DOM postMessage component. Recommendations Update to version 150 or later...

CVE-2026-35554

A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer...

CVE-2026-40338

A flaw was found in libgphoto2, a library for camera access and control. An out-of-bounds read vulnerability exists in the ptpunpackSonyDPD function. This occurs when the function attempts to read a 2-byte enumeration count without first verifying that sufficient data remains in the buffer. A loc...

CVE-2026-40477

A flaw was found in Thymeleaf, a server-side Java template engine. An unauthenticated remote attacker can exploit a security bypass vulnerability in the expression execution mechanisms. By providing unvalidated user input directly to the template engine, the attacker can bypass the library's...

CVE-2026-34232

A flaw was found in Firebird, an open-source relational database management system. The xdrstatusvector function, responsible for decoding server responses, does not properly handle a specific data type iscargcstring within an opresponse packet. An unauthenticated attacker can exploit this...

CVE-2026-35215

A flaw was found in Firebird. In the sdldesc function, a division by zero vulnerability exists due to improper validation of the length of a decoded SDL descriptor from a slice packet. An unauthenticated attacker can exploit this by sending a specially crafted slice packet, leading to a server...

firefox: thunderbird: Mitigation bypass in the Networking: HTTP component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Networking: HTTP component...