Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed.

This advisory covers a broad set of security vulnerabilities in Mozilla Thunderbird, fixed in versions 140.13 and 153. The flaws include an off-by-one out-of-bounds read in the MIME header parser (CVE-2026-14899), invalid pointer dereferences, site isolation issues, sandbox escapes due to use-after-free bugs, JIT miscompilations, privilege escalations, mitigation bypasses, and information disclosures in multiple components such as DOM navigation, JavaScript WebAssembly, Audio/Video (cubeb and GMP), Networking (HTTP, DNS, WebSockets), Storage (IndexedDB), and Graphics (WebGPU, ImageLib). Some vulnerabilities have publicly available exploit code, but no known in-the-wild exploitation has been reported. The vulnerabilities are mitigated by disabling scripting when reading mail, limiting direct exploitation via email. Red Hat's security update addresses these issues in Thunderbird versions prior to 140.13 and 153, including their Enterprise Linux AppStream versions 8, 9, and 10 on ppc64le architecture.

Detailed information about The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-o

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error,… (CVE-2026-14899) - Live Threat Intelligence - Threat Radar | OffSeq.com

https://access.redhat.com/errata/RHSA-2026:49621

https://access.redhat.com/security/updates/classification/#important

2499973

2499974

2503415

2503416

2503420

2503423

2503425

2503430

2503432

2503434

2503439

2503440

2503444

2503451

2503454

2503456

2503463

2503472

https://access.redhat.com/errata/RHSA-2026:49922

https://access.redhat.com/errata/RHSA-2026:49921

https://access.redhat.com/errata/RHSA-2026:53455

2503473

2503485

2503489

2503491

2503497

2503498

2503500

2503501

2503505

2503512

2503513

2503517

2503521

2503527

2506217

https://access.redhat.com/errata/RHSA-2026:53444

SUSE ratings

URL of this CSAF notice

SUSE CVE CVE-2026-14899 page

SUSE CVE CVE-2026-15718 page

SUSE CVE CVE-2026-15719 page

SUSE CVE CVE-2026-16349 page

SUSE CVE CVE-2026-16350 page

SUSE CVE CVE-2026-16351 page

SUSE CVE CVE-2026-16352 page

SUSE CVE CVE-2026-16353 page

SUSE CVE CVE-2026-16354 page

SUSE CVE CVE-2026-16355 page

SUSE CVE CVE-2026-16356 page

SUSE CVE CVE-2026-16357 page

SUSE CVE CVE-2026-16358 page

SUSE CVE CVE-2026-16359 page

SUSE CVE CVE-2026-16360 page

SUSE CVE CVE-2026-16361 page

SUSE CVE CVE-2026-16362 page

SUSE CVE CVE-2026-16363 page

MozillaThunderbird-140.13.0-1.1 on GA media

The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13.

The vulnerability CVE-2026-14899 in Mozilla Thunderbird involves an off-by-one error in the MIME header parser used when forwarding messages with the 'view all headers' setting enabled. This error permits reading one byte beyond the allocated buffer, which can lead to application crashes. The issue affects Thunderbird versions prior to 140.13 and prior to 153, with fixes applied in these versions. While exploitation via email is unlikely due to disabled scripting in mail reading, the vulnerability could pose risks in browser-like environments. The vendor advisory confirms the fix and rates the impact as moderate for this specific flaw, with an overall high severity rating due to the potential confidentiality impact. The vendor advisory also notes no known exploits in the wild and includes references to related security fixes in the same Thunderbird releases.

Detailed information about CVE-2026-14899: Vulnerability in Mozilla Thunderbird affecting Mozilla Thunderbird. Get real-time updates, technical details, and mit

CVE-2026-14899: Vulnerability in Mozilla Thunderbird - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-14899: Vulnerability in Mozilla Thunderbird


MozillaThunderbird-140.13.0-1.1 on GA mediaCVE-2026-14899 0 These are all security issues fixed in the MozillaThunderbird-140.13.0-1.1 package on the GA media of openSUSE Tumbleweed. MediumVulnerability#gcve #osv #ghsa-6667-m7mf-jcr7 Join the discussion	GCVE Database	07/24/2026, 00:00:00 UTC Added: 07/22/2026, 23:23:05 UTC
CVE-2026-14899: Vulnerability in Mozilla ThunderbirdCVE-2026-14899 0 The code to parse MIME headers for display when forwarding a message (if the setting to view all headers was enabled) had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in Thunderbird 153 and Thunderbird 140.13. HighVulnerability#cve #cve-2026-14899 Join the discussion	CVE Database V5	07/22/2026, 19:19:42 UTC Added: 07/22/2026, 20:08:01 UTC

Threats Tagged 'cve-2026-14899'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2026-14899'

Lead Pen Test Professional