id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
24260	thunderbird-153.7.0esr	Joe Locash	SecurityAdvisory	"What’s Fixed:
 - Opening a window could cause Thunderbird to crash
 - MP4 attachments could be truncated when forwarding messages
 - Exchange autodiscovery failed when redirected to another email address
 - Legacy IMAP tag changes were not sent to the server and reverted after refresh
 - SMTP Kerberos authentication failed on Linux with STARTTLS

Security fixes:

These are specific to thunderbird:
 - CVE-2026-126132: Attachments could be replaced with local file content when forwarding (high)
 - CVE-2026-126133: Calendar server credentials could be sent to an HTTP proxy (moderate)
 - CVE-2026-126134: Feed subscriptions could leak NTLM credentials on Windows (moderate)
 - CVE-2026-126135: SMTP and POP3 response injection when using STARTTLS (moderate)
 - CVE-2026-126136: OAuth2 access token could be sent over an unencrypted connection with Exchange accounts (moderate)

https://www.mozilla.org/en-US/security/advisories/mfsa2026-129/
"	enhancement	new	high	98-Security	BOOK	git	high