CVE-2026-109779 Race condition in the Networking: DNS component

Race condition in the Networking: DNS component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109781 Denial-of-service in the Printing: Output component

Denial-of-service in the Printing: Output component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109777 Information disclosure in the Storage: IndexedDB component

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109773 Denial-of-service in the Sync component

Denial-of-service in the Sync component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109775 Denial-of-service in the WebRTC component

Denial-of-service in the WebRTC component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109771 Information disclosure in the WebRTC: Networking component

Information disclosure in the WebRTC: Networking component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109768 Denial-of-service in the Site Reports component

Denial-of-service in the Site Reports component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109769 Information disclosure in the Networking: Cache component

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109765 Race condition, use-after-free in the Graphics: Text component

Race condition, use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109767 Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109761 Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109756 Privilege escalation in the DOM: Navigation component

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109751 Information disclosure in the Networking component

Information disclosure in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109752 Use-after-free in the DOM: Workers component

Use-after-free in the DOM: Workers component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109749 Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109748 Use-after-free in the JavaScript: WebAssembly component

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109742 Information disclosure in the PDF Viewer component

Information disclosure in the PDF Viewer component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109741 Use-after-free in the Storage: Bucket File System component

Use-after-free in the Storage: Bucket File System component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109738 Use-after-free in the Audio/Video: Playback component

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109735 Use-after-free in the DOM: Animation component

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158 and Thunderbird 158...

CVE-2026-109709 Information disclosure, privilege escalation in the Security: Process Sandboxing component

Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5...

CVE-2026-109728 Use-after-free in the DOM: Animation component

Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109732 Use-after-free in the DOM: Streams component

Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109729 Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109719 Race condition, use-after-free in the Graphics: CanvasWebGL component

Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5...

CVE-2026-109718 Use-after-free in the XML component

Use-after-free in the XML component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5...

CVE-2026-109404 conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is...

CVE-2026-94410 Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service

A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected...

CVE-2026-109832 Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted)

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results GNUTLSEAGAIN and GNUTLSEINTERRUPTED are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC...

CVE-2026-109189 fit2cloud MeterSphere Swagger3 Swagger3ParserApiDefinition.java Swagger3ParserApiDefinition.testUrlTimeout server-side request forgery

A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the component Swagger3 Parser. Performing a manipulation of the...

CVE-2026-109155 DeepPavlov Model Download untar path traversal

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109152 jbardin scp.py SCP Receive _recv_pushd path traversal

A security vulnerability has been detected in jbardin scp.py up to 0.16.1. The impacted element is the function recvfile/recvpushd of the component SCP Receive Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. Upgrading to version 0.16.2 is sufficie...

CVE-2026-102076

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

CVE-2026-102075

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

CVE-2026-102074

A vulnerability has been identified in APOGEE MBC PPC BACnet All versions, APOGEE MBC PPC P2 Ethernet All versions, APOGEE MEC PPC BACnet All versions, APOGEE MEC PPC P2 Ethernet All versions, APOGEE PXC Compact BACnet All versions V3.5.7, APOGEE PXC Compact P2 Ethernet All versions V2.8.21, APOG...

CVE-2026-89208

A vulnerability has been identified in Capital Embedded AR Classic 431-422 All versions, Capital Embedded AR Classic R20-11 All versions = V2.3, Desigo PXC00-U All versions = V2.3, Desigo PXC001-E.D All versions = V2.3, Desigo PXC100-E.D All versions = V2.3, Desigo PXC12-E.D All versions = V2.3,...

CVE-2026-89206

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delet...

CVE-2026-89205

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operation...

CVE-2026-89204

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized...

CVE-2026-89203

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker ...

CVE-2026-89200

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands...

CVE-2026-89199

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal...

CVE-2026-89198

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the...

CVE-2026-78557

A vulnerability has been identified in Industrial Edge App Publisher All versions V1.27.9. The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for...

CVE-2026-63356

Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a...

CVE-2026-63355

Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially...

CVE-2026-63351

Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into...

CVE-2026-63350

Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow...

CVE-2026-109144 wbond certvalidator Certificate Path Builder resource consumption

A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-109699 WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8...