id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
24151	thunderbird-153.5.1esr	Joe Locash	SecurityAdvisory	"What’s Fixed:
 - Failed account setup left incoming servers that blocked subsequent setup attempts

Security fixes:
 - CVE-2026-113866: Account password sent unencrypted during Exchange account setup (high)
 - CVE-2026-113867: Stanza injection in XMPP chat (high)
 - CVE-2026-113868: Uninitialized memory disclosure and out-of-bounds read in POP3 and SMTP NTLM authentication (high)
 - CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (high)

https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/
"	enhancement	new	high	98-Security	BOOK	git	high