CVE-2026-110836

FreeRDP from 3.0.0 before 3.32.0 contains an infinite loop vulnerability in httpresponserecv that allows malicious gateways to exhaust client CPU via crafted Content-Type headers. Attackers controlling a gateway can return a nonzero Content-Length with a semicolon-containing unrecognized...

CVE-2026-101025

Description NGINX JavaScript njs has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse fails. The failure path did not register cleanup and the context was not released for the lifetime of the process. An unauthenticated attacker may send requests with...

CVE-2026-110829

FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNELFLAGLAST without CHANNELFLAGFIRST. A malicious RDP server can send a malformed rdpsnd PDU on a fresh channel to crash the client and cause denial of service...

CVE-2026-110658

Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msgmultipartparse that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length...

CVE-2026-104086

7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler SquashfsHandler.cpp that allows attackers to leak heap memory by crafting a malicious archive where the superblock’s noids field is set so that the final metadata block’s expected size ...

CVE-2026-109768

Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109769

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109735

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-107778

MIT Kerberos 5 krb5 through 1.22.2 contains a NULL pointer dereference in makecredlist in rdcred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticketinfo entries through...

CVE-2026-110926

A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths...

CVE-2026-92877

The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker who can get untrusted XML unmarshalled through JAXB can read local...

CVE-2026-107708

MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's getpacprincwithrealm that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a...

CVE-2026-110141

Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-15176

A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $requestfilename variable. Alternatively, the same result could be achieved when the $requestfilename variable...

CVE-2026-109705

Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109707

Sandbox escape due to use-after-free in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109709

Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109712

Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109715

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109717

Use-after-free in the DOM: Bindings WebIDL component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109728

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109754

Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109743

Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109759

Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109781

Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109757

Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109760

Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109770

Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109734

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109762

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109767

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109733

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109765

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109737

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-110259

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions that allows attackers to cause denial of service through crafted class files. Attackers can supply a class with a large method containing many long forward jumps, triggering unbounded...

CVE-2026-110270

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers can supply a crafted class file with nested subroutines to force O2^n memory allocation, causing an...

CVE-2026-109766

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-110249

A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough attributes to keep Thunderbird's main thread CPU-bound for seconds to hours. This vulnerability was fixed in Thunderbird 158 and Thunderbird 153.5...

CVE-2026-109731

Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109752

Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109764

Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109763

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109751

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-110158

Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-109756

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109855

undici is an HTTP client library for Node.js. In versions 8.11.0 and 8.11.1, its experimental WebSocket client, which is enabled by default when HTTP/2 is allowed, mishandles a failed WebSocket handshake over HTTP/2: the request is already marked completed, so the abort becomes a no-op and the...

CVE-2026-109738

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109742

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109778

Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-110838

FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input PDUs during the Confirm Active state before authentication, allowing unauthenticated attackers to inject keyboard input. Attackers can negotiate TLS-only RDP and send an input PDU without Confirm Active to inject synthetic keystrokes...