CVE-2026-117872

Use-after-free in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117876

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117873

Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117874

Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117867

Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117870

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117883

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117884

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117886

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117878

Other issue, use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117885

Use-after-free in the Layout: Grid component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117864

Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117865

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117863

Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117860

Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117862

Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-117861

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6...

CVE-2026-116748

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handlerequest in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enablin...

CVE-2026-116802

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSERMEDIATYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers can submit SVG with an animate or set...

CVE-2026-116804

DOMPurify from 3.4.4 before 3.4.17 contains a SAFEFORTEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURNDOM, RETURNDOMFRAGMENT, or INPLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which mer...

CVE-2026-116803

DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an INPLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers like img onerror fire after sanitize...

CVE-2026-116744

ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissectsoftetherhostfqdn in softether.c that compares hostname using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp t...

CVE-2026-57188

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in resxmpp XMPP namespace prefix handling using carefully craft...

CVE-2026-57198

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The chansip channel...

CVE-2026-57185

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully...

CVE-2026-57194

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in chanunistim DIALPAGE digit handling can overflow the phonenumber field and crash Asterisk when an...

CVE-2026-57201

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace trace-logging function can occur when unbounded vsprintf writes into a fixed...

CVE-2026-57202

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface ARI attacker with read-only privileges may use setChannelVar to execute write...

CVE-2026-57189

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to...

CVE-2026-57197

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded memcpy of OGG/Speex packet data in formatoggspeex can cause a heap buffer overflow and crash Asterisk when...

CVE-2026-116577

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An unauthenticated client can submit a head...

CVE-2026-115927

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can send millions of one-byte chunks to...

CVE-2026-116578

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start o...

CVE-2026-116579

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompressmessagedata in compressbrotli.py calls the Brotli decompressor without an output limit and checks maxMessagePayloadSize only after a complete...

CVE-2026-116840

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

CVE-2026-116829

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...

CVE-2026-116816

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llmtokenizerplamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like whose negative parsed value writes token ids before the bytes buffer...

CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-109090

A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4...

CVE-2026-109089

A buffer overflow when handling DEVICERESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server...

CVE-2026-65625

The pure-Erlang AES-GCM fallback in josejwaaes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the aesgcm, Bits clause of blockdecrypt/4, the incoming tag is guarded only by isbinary/1, with no check on its length. Verification in gcmblockdecrypt/6...

CVE-2026-65629

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with josejwk:toder/2...

CVE-2026-65628

josejwk:sharedsecret/2 exposed in Elixir as JOSE.JWK.sharedsecret/2 derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type kty module, and its fallback clause re-invokes itself as sharedsecretfromYourJWK, fromMyJWK. Because from/...

CVE-2026-65627

Improper Handling of Highly Compressed Data Data Amplification vulnerability in potatosalad jose erlang-jose allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The josejwezip:uncompress/2 function in src/jwe/josejwezip.erl decompresses the DEFLATE-compressed...

CVE-2026-65626

The pure-Erlang RSAES-PKCS1-v15 decryption in the josejwapkcs1 module is a Bleichenbacher padding oracle. emepkcs1decode/2 returns the recovered message when a decrypted block has valid PKCS1 v1.5 padding a leading 0x00 0x02, a padding string of at least eight non-zero bytes, and a 0x00 separator...

CVE-2026-65630

Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over the secret private key using a recursiv...

CVE-2026-65631

Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public josejwk:frombinary/1 or josejwk:frommap/1 API or the...

CVE-2026-65632

The jose library accepts ECDSA ES256, ES256K, ES384, and ES512 JWS signatures of a non-canonical length. When verifying an ECDSA signature, josejwkktyec:verify/4 in src/jwk/josejwkktyec.erl splits the raw signature in half by its actual byte length splitbinarySignature, bytesizeSignature div 2...

CVE-2026-57196

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an...

CVE-2026-57187

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a...