EUVD-2026-60674

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

CVE-2026-75874

A critical (CVSS 10.0) sandbox escape in Firefox and Thunderbird's Remote Settings Client component allows remote, unauthenticated attackers to break out of the application sandbox and achieve full system compromise. No exploitation has been reported, but the flaw affects any Firefox/Thunderbird ...

CVE-2026-75874

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

CVE-2026-75874 Sandbox escape in the Remote Settings Client component

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

CVE-2026-74942

A privilege escalation flaw in Firefox's Remote Settings Client component allows a remote attacker to gain full system access with no authentication and low complexity. CVSS 8.8 (HIGH). CISA's SSVC rates technical impact as total but confirms no active exploitation. Fixed in Firefox 154, Firefox ...

CVE-2026-74942 Privilege escalation in the Remote Settings Client component

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74942

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

EUVD-2026-60749

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74942

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74942 Privilege escalation in the Remote Settings Client component

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

PT-2026-77024

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Thunderbird versions prior to 154 Description A sandbox escape exists in the Remote Settings Client component. A sandbox is a security mechanism for separating running programs, ensuring that code executing in a...

PT-2026-76975

Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1...

EUVD-2026-60257

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

CVE-2026-75058

XML External Entity (XXE) injection in IntelliJ IDEA's Eclipse settings importers affects versions before 2026.2.1. CVSS 5.5 (MEDIUM) — local attack, no privileges, high confidentiality impact. Remediation: upgrade to IntelliJ IDEA 2026.2.1 or later. No in-the-wild exploitation reported. Details:...

CVE-2026-75058

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

WordPress bLoyal: Loyalty & Promotions by bLoyal plugin <= 3.1.611.78 - Authenticated (Subscriber+) Privilege Escalation via Unprotected AJAX API URL Settings vulnerability

Authenticated Subscriber+ Privilege Escalation via Unprotected AJAX API URL Settings vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin bLoyal versions = 3.1.611.78...

PT-2026-76707

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers...

CVE-2026-15345

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-10035 Turnkey bbPress by WeaverTheme <= 1.7.1 - Authenticated (Administrator+) PHP Object Injection

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbpsettoserializedvalues function reached through the wvrbbpsaverestore settings-restore handler. The function...