Full remote takeover of Oracle WebCenter Content (Fusion Middleware Content Server) is possible when an unauthenticated attacker reaches the HTTP interface, per Oracle's July 2026 Critical Patch Update (CPU). The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0 and yields complete compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8). No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and Oracle 'takeover' language make it a top-priority patch.
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.
Full takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is possible by unauthenticated remote attackers reaching the T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the T3/IIOP attack surface is a historically abused deserialization vector on the underlying WebLogic stack, warranting priority patching.
Full takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker can compromise the platform over HTTP. Oracle rates this a CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by an unauthenticated remote attacker who reaches the T3 or IIOP protocol endpoints. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, carrying a maximum-severity CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the T3/IIOP attack surface is historically a high-value target in the Oracle WebLogic/Fusion stack.
Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Full compromise of Oracle HTTP Server (Oracle Fusion Middleware) is possible via the bundled Apache Plugin (mod_wl/proxy) component in supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a network-based unauthenticated attacker to take over the server over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this is one of the highest-severity issues in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low-complexity, no-privilege, no-interaction profile makes it a top-priority patch.
Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware, OIM Legacy UI component) allows an unauthenticated network attacker to fully compromise the identity governance server via the T3 and IIOP protocols. Oracle rates it CVSS 3.1 9.8 with high confidentiality, integrity and availability impact and describes it as 'easily exploitable', meaning a successful attack yields complete product takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low complexity and unauthenticated network vector make it a top-priority patch.
Complete takeover of Oracle Access Manager is possible when an unauthenticated attacker with network access sends crafted HTTP requests to the Authentication Engine component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0 and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). It was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Remote unauthenticated takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) allows an attacker with only HTTP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 9.8 (Critical) with full confidentiality, integrity, and availability impact and describes it as easily exploitable, meaning no authentication, credentials, or user interaction are needed. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the combination of unauthenticated network reach and complete compromise makes this a high-priority patch item.
Full remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) versions 12.2.1.4.0 and 14.1.1.0.0 is possible by an unauthenticated attacker sending crafted traffic over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is rated by Oracle as 'easily exploitable,' meaning no special skill or configuration is needed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication profile makes it a high-priority patch target.
Complete takeover of Oracle Coherence is possible when an unauthenticated remote attacker reaches the Core component over HTTPS, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, and the CVSS 3.1 base score of 9.8 reflects full confidentiality, integrity, and availability compromise with no privileges or user interaction. No public exploit identified at time of analysis, but the low attack complexity and 'easily exploitable' framing from Oracle make this a high-priority patch.
Remote takeover of Oracle Coherence (Core component) allows an unauthenticated attacker with TCP network access to fully compromise the in-memory data grid, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and no required privileges or user interaction. No public exploit identified at time of analysis, but the trivial exploitability and full-takeover impact make this a high-priority patch for affected Fusion Middleware deployments.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) lets an unauthenticated attacker with only HTTP/2 network reachability fully compromise the affected data-grid instance. Supported versions 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and Oracle rates the flaw CVSS 9.8 with high confidentiality, integrity and availability impact. No public exploit has been identified at time of analysis and it is not in CISA KEV, but the easily exploitable, network-facing, unauthenticated nature makes this a top-priority patch.
Remote takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) allows an unauthenticated attacker with TCP network access to fully compromise the product across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this CVSS 9.8 with high confidentiality, integrity, and availability impact, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special conditions are required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and complete-takeover impact make it a high-priority patch in the July 2026 Oracle Critical Patch Update.
Full compromise of Oracle Coherence (Oracle Fusion Middleware Core) is possible by unauthenticated attackers with TCP network access, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 and described by Oracle as 'easily exploitable,' allowing complete takeover of the in-memory data grid across supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network-takeover profile makes it a high-priority patch.
Complete takeover of Oracle Coherence is possible by unauthenticated remote attackers over TCP against the Core component in Oracle Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Oracle rates this 'easily exploitable' with full confidentiality, integrity, and availability compromise (CVSS 9.8), fixed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and the flaw is not on CISA KEV, so exploitation is currently theoretical but the barrier is minimal.
Full remote takeover of Oracle Coherence (part of Oracle Fusion Middleware, Core component) in versions 12.2.1.4.0 and 14.1.1.0.0 is achievable by an unauthenticated attacker with only HTTP network access, per the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with High Confidentiality, Integrity, and Availability impact (base score 9.8). Oracle rates it 'easily exploitable' and describes the outcome as complete compromise of Coherence. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial-access profile makes it a high-priority patch in the Oracle July 2026 Critical Patch Update.
Remote code execution and full takeover in Oracle Coherence (Oracle Fusion Middleware, Core component) versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows an unauthenticated attacker with HTTP network access to completely compromise the product, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and is described by Oracle as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated network vector and 'takeover' impact make it a top-priority patch candidate.
Full takeover of Oracle Coherence (Oracle Fusion Middleware, Core component) can be achieved by unauthenticated remote attackers sending crafted HTTP traffic, affecting versions 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this CVSS 9.8 with complete confidentiality, integrity, and availability loss, and describes it as 'easily exploitable,' meaning no authentication, user interaction, or special preconditions are required. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Complete takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, affecting the Core component in Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates this 'easily exploitable' with a CVSS 3.1 base score of 9.8 and full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the low attack complexity and unauthenticated network vector make it a high-priority patch item.
Remote takeover of Oracle Siebel CRM (Siebel CRM Development, Siebel Approval Manager component) is possible by an unauthenticated attacker sending crafted HTTP requests, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact, affecting supported versions 17.0 through 26.3. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list, but the unauthenticated network-facing profile makes it a high-priority patch item.
Complete product takeover in Oracle Enterprise Manager Base Platform (versions 13.5 and 24.1) allows an unauthenticated remote attacker to fully compromise the management platform via the Agent Next Gen component over HTTPS. The CVSS 3.1 base score of 9.8 reflects total loss of confidentiality, integrity, and availability with no privileges or user interaction required. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the trivial exploitability and full-takeover impact make this a high-priority patch item from Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Retail Integration Bus 14.1.3.2 (RIB Kernel component) allows a remote, unauthenticated attacker to take over the product over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw is rated CVSS 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote takeover of Oracle Application Testing Suite 13.3.0.1 allows an unauthenticated attacker with TCP network access to fully compromise the product without any user interaction. The flaw carries a CVSS 3.1 base score of 9.8 with complete confidentiality, integrity, and availability impact, and is addressed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Memory corruption in Mozilla Firefox 152 and Firefox ESR 140.12 could allow attackers to run arbitrary code within the browser, per Mozilla advisories MFSA2026-68 and MFSA2026-70. The flaw is a batch of internally-discovered memory safety bugs (CWE-119) affecting the Firefox rendering/JavaScript engine, at least some of which showed evidence of exploitable memory corruption. No public exploit identified at time of analysis; the issues were reported by Mozilla itself and fixed in Firefox 153 and Firefox ESR 140.13.
Memory corruption in Mozilla Firefox 152 lets a remote attacker who lures a victim to a malicious web page trigger memory-safety violations that Mozilla assesses could be leveraged for arbitrary code execution. The flaw is one of a batch of internally-discovered memory safety bugs (CWE-119) rolled up under MFSA2026-68 and carries a CVSS 9.8 rating; there is no public exploit identified at time of analysis, and it is fixed in Firefox 153.
Memory-corruption in Mozilla Firefox ESR 115.37 and 140.12 could allow attackers to run arbitrary code by triggering memory-safety bugs (CWE-119) that Mozilla observed showing evidence of memory corruption. Reported by Mozilla and tracked under advisories MFSA2026-69/70, the flaw is remotely reachable and carries a CVSS 9.8, though there is no public exploit identified at time of analysis and no active-exploitation (KEV) listing. Mozilla explicitly frames exploitation as presumptive ('with enough effort'), indicating no confirmed working exploit.
Memory-corruption via integer overflow in the Audio/Video Playback component of Mozilla Firefox lets a remote attacker who serves crafted media content trigger heap corruption that can lead to arbitrary code execution in the browser process. All Firefox versions prior to 153 are affected, and the NVD-assigned CVSS 3.1 base score of 9.8 (network vector, no privileges, no user interaction) reflects a full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the score reflects potential rather than observed exploitation.
Memory-corruption via an integer overflow in Mozilla Firefox's Audio/Video component allows remote attackers to compromise the browser when a victim processes attacker-controlled media, with the CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicating unauthenticated network exploitation and high impact to confidentiality, integrity, and availability. The flaw was fixed in Firefox 153 per Mozilla advisory MFSA2026-68. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sensitive information disclosure in DayuanJiang next-ai-draw-io 0.4.13 lets a remote attacker spoof the X-Forwarded-For HTTP header to impersonate a trusted client address and bypass IP-based access controls, exposing protected data. The flaw is classified as authentication bypass by spoofing (CWE-290) and, per the CVSS vector, requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS probability is low at 0.22%.
Privilege escalation via SQL injection in Crocus version 1.3.44 allows remote attackers to manipulate backend database queries through the DeviceInfoMapper.xml data-access layer, yielding full read/write control over application data. The flaw carries a CVSS 9.8 (network, no authentication) rating, and publicly available exploit code exists in a GitHub write-up, though it is not listed in CISA KEV and its EPSS exploitation probability is low (0.20%, 10th percentile).
SQL injection in WGCLOUD 3.6.4 lets remote attackers inject arbitrary SQL through unsanitized parameters bound in the PortInfoMapper.xml MyBatis mapper, enabling database manipulation that can be leveraged to escalate privileges within the monitoring platform. The flaw is remotely reachable and rated critical (CVSS 9.8), with publicly available exploit code exists in the form of a detailed write-up, though EPSS remains low (0.20%, 10th percentile) and there is no public exploit identified as actively used. WGCLOUD is an open-source IT infrastructure/host monitoring system, so a compromise exposes credentials and monitoring data for every managed host.
Stack buffer overflow in the Perl module Data::RingBuffer::Shared before 0.04 lets a local peer with write access to the shared memory backing file corrupt adjacent stack frames. The attach-time header validator (ring_validate_header) checks capacity-overflow and total_size consistency but never bounds elem_size, so ring_read_seq memcpys a file-controlled length into a fixed 8-byte destination scalar. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and it is not on CISA KEV, but the memory-corruption primitive is unambiguous and a vendor patch (0.04) exists.
SQL injection in Crocus version 1.3.44 lets a remote attacker manipulate database queries through the RecordStateMapper.xml mapper and escalate privileges within the application. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high impact on confidentiality, integrity and availability. A public write-up/proof-of-concept exists on GitHub, though the flaw is not listed in CISA KEV and EPSS is low (0.19%, 8th percentile), indicating no confirmed active exploitation to date.
Cross-tenant self-service signup bypass in Microsoft Azure API Management (through 2025-10-17) lets remote unauthenticated actors register developer-portal accounts against a tenant where signup was disabled in the UI, by swapping the Host header or tenant identifier to reuse another tenant's still-live registration endpoint. Publicly available proof-of-concept exploit code exists (GHSA-vcwf-73jp-r7mv), but Microsoft evaluated the report and determined the behavior did not cross a security boundary, calling it a configuration/state issue rather than a product vulnerability affecting tenant isolation. No public in-the-wild exploitation has been identified, and the EPSS probability is low (0.18%, 7th percentile).
Out-of-bounds read and write in the Perl module Data::DisjointSet::Shared before version 0.02 lets a local actor who can write the shared backing file corrupt process memory or crash consumers of the disjoint-set structure. The dsu_find routine trusts a file-stored parent index that is never bounds-checked against the node count, so the next find or union operation dereferences and path-compresses through an out-of-bounds pointer. No public exploit is identified at time of analysis, and the EPSS score is very low (0.17%), consistent with a niche CPAN module rather than a broadly exploited target.
Remote arbitrary code execution in Bytebot (bytebot-ai self-hosted AI desktop agent, commit 3d37894 dated 2025-09-11) allows attackers to run OS commands by supplying a crafted path to the agent's `computer_write_file` action. The flaw is classed as OS command injection (CWE-78) and carries a CVSS 9.8, but real-world exploitation probability is currently low (EPSS 0.17%, 7th percentile) and it is not on CISA KEV. A public gist referenced by the CVE appears to document the issue and may contain proof-of-concept details, though POC status is not explicitly confirmed in the source data.
Security-mitigation bypass in Mozilla Firefox's DOM: Networking component undermines a built-in protection mechanism (CWE-693), potentially allowing crafted web content to defeat network-layer defenses in versions prior to Firefox 153 and ESR 140.13. The issue was reported and patched by Mozilla with no public exploit identified at time of analysis; EPSS is very low (0.16%, 6th percentile) and it is not listed in CISA KEV. The NVD-assigned CVSS of 9.8 (network, no auth, no user interaction) sits in tension with the sparse 'mitigation bypass' description, which typically describes a defense-defeating enabler rather than direct code execution.
Mitigation bypass in the Mozilla Firefox PDF Viewer component undermines a built-in security control (CWE-693 Protection Mechanism Failure), weakening a defense-in-depth barrier that would otherwise contain malicious PDF content. Mozilla self-reported the issue and shipped fixes in Firefox 153 and Firefox ESR 140.13 via advisories MFSA2026-68 and MFSA2026-70. There is no public exploit identified at time of analysis, and EPSS is very low (0.16%, 6th percentile), so the headline CVSS 9.8 reflects worst-case potential rather than demonstrated mass exploitation.
Same-origin policy bypass in Mozilla Firefox's DOM: Navigation component allows a malicious web page to read or manipulate content belonging to another origin, defeating the browser's core cross-origin isolation boundary. All Firefox users on affected pre-153 releases and unpatched ESR branches are exposed, and while Mozilla's vector maps to CVSS 9.8, EPSS estimates only a 0.16% exploitation probability (6th percentile). There is no public exploit identified at time of analysis and it is not in CISA KEV.
Privilege escalation in Gitea's self-hosted Git service (all versions ≤ 1.26.4) lets an attacker holding a narrowly-scoped Personal Access Token mint a new token with any scope, including full 'all' access, without the account password. The POST /users/{username}/tokens endpoint is guarded by reqBasicOrRevProxyAuth, which is meant to force password auth, but supplying the token as Authorization: Basic base64(<token>:x-oauth-basic) tricks the guard into setting IsBasicAuth=true, and the token-creation handler enforces no scope ceiling. A working proof-of-concept integration test is published in the advisory, though there is no public exploit identified in the wild and EPSS is low (0.16%).
Cross-origin information disclosure in Mozilla Firefox arises from a site isolation weakness in the Graphics: WebRender rendering component, where origin boundaries are not correctly enforced during GPU-accelerated compositing. An attacker-controlled web page loaded by a victim could leak data belonging to a different origin, undermining the same-origin protections that site isolation is meant to guarantee. Mozilla fixed the issue in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in the Graphics component of Mozilla Firefox stems from incorrect boundary conditions (a buffer overflow) that can be triggered when the browser processes maliciously crafted graphics content, potentially leading to arbitrary code execution in the content process. It affects Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13, and is fixed across those releases per Mozilla advisories MFSA2026-68/69/70. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.15%, 5th percentile) despite the vendor-supplied CVSS of 9.8.
Sandbox escape via use-after-free in Mozilla Firefox's Disability Access (accessibility) APIs allows an attacker who has compromised the content process to break out of the browser sandbox and gain code execution at the host privilege level. It affects Firefox before 153 and the ESR 115.x and 140.x branches, was reported and patched by Mozilla, and carries no public exploit at time of analysis. EPSS is low (0.15%, 5th percentile) and it is not on CISA KEV, indicating no observed exploitation.
Memory corruption in Mozilla Firefox's JavaScript engine JIT compiler allows attackers to corrupt memory and potentially achieve arbitrary code execution when a victim visits a malicious web page. The flaw stems from a JIT miscompilation (type confusion, CWE-843) affecting Firefox before 153, ESR before 115.38, and ESR before 140.13, and carries CVSS 9.8. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 5th percentile).
Memory corruption in Mozilla Firefox's DOM Bindings (WebIDL) layer allows a remote attacker who serves malicious web content to trigger a use-after-free (CWE-416) via an invalid/dangling pointer, potentially leading to arbitrary code execution or information disclosure in the content process. All Firefox and Firefox ESR builds prior to the fixed releases are affected. There is no public exploit identified at time of analysis, and the low EPSS score (0.15%, 5th percentile) suggests exploitation is not yet observed in the wild, though Mozilla rates the memory-safety impact as high.
Sandbox escape in Mozilla Firefox stems from a use-after-free in the Disability Access (accessibility) APIs, letting an attacker who already controls a sandboxed content process break out of the browser sandbox and compromise the host. It affects Firefox before 153 and the ESR 115.x and 140.x branches, with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the EPSS score is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Mozilla Firefox stems from a use-after-free (CWE-416) in the DOM: Navigation component, letting web-reachable content corrupt memory and cross the content-process sandbox boundary. Affected builds are Firefox before 153, Firefox ESR before 115.38, and Firefox ESR before 140.13; Mozilla self-reported the issue and shipped fixes across all three branches (MFSA-2026-68/69/70). There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed weaponization yet despite the 9.8 CVSS rating.
Memory corruption in the cubeb audio/video library used by Mozilla Firefox arises from incorrect boundary conditions (CWE-119), and Mozilla fixed it in Firefox 153, Firefox ESR 115.38, and Firefox ESR 140.13 (advisories MFSA2026-68/69/70). The input CVSS rates it 9.8 (network, no privileges, no user interaction), implying an unauthenticated remote attacker could corrupt memory in the browser and potentially achieve code execution, though as a media-processing flaw real exploitation almost certainly requires a victim to render attacker-controlled audio/video content. There is no public exploit identified at time of analysis and EPSS is low (0.15%, 5th percentile), and it is not in CISA KEV.