https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-29T04:10:54.085299+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/certfr-2026-avi-1406 certfr-2026-avi-1406 — De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un atta… 2026-10-29T04:10:54.087519+00:00 certfr-2026-avi-1406 https://db.gcve.eu/vuln/fkie_cve-2026-118179 fkie_cve-2026-118179 2026-10-29T04:10:54.087572+00:00

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

 https://db.gcve.eu/vuln/ghsa-gm4x-83qc-5rx5 GHSA-gm4x-83qc-5rx5 2026-10-29T04:10:54.087620+00:00

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

 https://db.gcve.eu/vuln/ubuntu-cve-2026-118179 UBUNTU-CVE-2026-118179 2026-10-29T04:10:54.087645+00:00

Affected: Ubuntu:18.04:LTS: mozjs52, Ubuntu:18.04:LTS: mozjs38, Ubuntu:20.04:LTS: mozjs68, Ubuntu:20.04:LTS: mozjs52, Ubuntu:22.04:LTS: mozjs102, Ubuntu:22.04:LTS: mozjs78, Ubuntu:22.04:LTS: mozjs91, Ubuntu:22.04:LTS: thunderbird, Ubuntu:24.04:LTS: mozjs102, Ubuntu:24.04:LTS: mozjs115

Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.