First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-12310

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-119 CWE-125 CWE-416 CWE-787

Affected software

Vendor	Product	Versions
Mozilla	Firefox	—
Mozilla	Thunderbird	—

References

https://bugzilla.mozilla.org/show_bug.cgi?id=2039707Permissions Required
https://www.mozilla.org/security/advisories/mfsa2026-57/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-58/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-60/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2026-61/Vendor Advisory

Timeline

Published: Jun 16, 2026
Last modified: Oct 26, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-123114.7Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox E CVE-2026-1231192.3The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts, allowing for DNS rebinding CVE-2026-123127.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbir CVE-2026-1231256.5The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip constraint, so some i CVE-2026-1231283.7The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users CVE-2026-1231295.3The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthent CVE-2026-123134.7Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox E CVE-2026-1231315.9The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily CVE-2026-1231348.8The Smoove abandoned cart trigger for WooCommerce WordPress plugin before 4.3.6 does not sanitise and escape abandoned-cart data submitted b CVE-2026-1231356.3A vulnerability was found in langgenius dify up to 1.18.0/2.0.0-beta.2. Affected by this vulnerability is an unknown functionality of the fi CVE-2026-1231395.8Improper verification of the source of a communication channel vulnerability in Opera Neon on macOS and Windows allows a malicious browser e CVE-2026-123147.5Memory safety bug fixed in Thunderbird 152. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbir