Command injection in simple-git and its @simple-git/argv-parser package prior to 2.0.1 lets an attacker who can influence environment values forwarded by a consuming Node.js application cause Git to launch an attacker-selected editor executable, which runs with the privileges of the Node.js process. The root cause is that parseEnv's GitEnvKeys allowlist omits VISUAL, so prepareEnv silently drops the key before vulnerabilityCheck can classify it as allowUnsafeEditor, letting the value pass through to Git during editor-invoking operations such as commit amendment or interactive rebase. Exploitation requires the wrapping application to unsafely propagate untrusted environment input, the attacker to control VISUAL, and no higher-priority editor setting (GIT_EDITOR, core.editor, or a higher-priority EDITOR) to shadow it, which is why the assessed vector carries AC:H and AT:P despite the high 9.2 CVSS 4.0 base - no public exploit identified at time of analysis, and the flaw is fixed in argv-parser 2.0.1.
Memory corruption in Mozilla Firefox's WebGPU graphics component (versions prior to 157) can be triggered when a user loads attacker-controlled web content that drives the vulnerable rendering path, yielding a buffer overflow with high confidentiality and availability impact. The flaw is remote, requires no authentication, and exploitation depends on the victim rendering a malicious page, so practical attacks rely on phishing, malvertising, or a compromised site rather than zero-click delivery. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.15% (4th percentile), though the vendor's 9.1 CVSS rating and a patch in Firefox 157 indicate a serious memory-safety defect that should be prioritized for browser fleet updates.
Missing authorization checks in the MediaWiki TemplateSandbox extension let unauthenticated remote users reach functionality that should be constrained by access-control lists, yielding a CVSS 3.1 base score of 9.1 with high confidentiality and integrity impact but no availability impact. Exposure is limited to wikis that have the optional TemplateSandbox extension installed and enabled; a default MediaWiki core installation is not affected, and the fixed releases are 1.46.1, 1.45.5, and 1.43.10 for their respective branches. No public exploit code has been identified at time of analysis (EPSS 0.15%, 3rd percentile) and CISA SSVC records exploitation as none, although the issue is rated automatable with total technical impact, so the risk is serious but not yet observed as active.
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD (versions 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets unauthenticated remote attackers complete SSH authentication by submitting the literal username "*" with the password "*", because LDAP filter metacharacters from user-supplied credentials are not escaped before being embedded in the search filter. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), the flaw is trivially reachable but only on servers that both embed the MINA SSHD library and have deployed and configured sshd-ldap for password or publickey authentication; stock MINA SSHD deployments without that optional component are entirely unaffected, and no public exploit code was identified at time of analysis. Apache ships fixes in 2.20.0 and 3.0.0-M6, which apply proper RFC 4515 escaping.
Authentication bypass in the optional sshd-ldap component of Apache MINA SSHD allows unauthenticated remote attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to pass password authentication checks when an SSH server is configured to use LdapPasswordAuthenticator, yielding high confidentiality and integrity impact (rated 9.1 critical). Affected builds are 1.2.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5; servers that rely on sshd-core's built-in password mechanisms, or that do not use sshd-ldap at all, are not affected. No public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing), but real-world exposure is sharply limited by the non-default optional component and the explicit LDAP authenticator configuration required - the raw 9.1 score is driven by impact rather than by a broad exploitable population.
An authentication bypass in Apache MINA SSHD's sshd-core library (versions 2.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) allows remote, unauthenticated attackers to skip signature verification during public-key or hostbased SSH authentication, potentially granting an attacker a valid session. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (9.1 critical) reflects high confidentiality and integrity impact, but exploitation is gated by a non-default precondition: the server operator must have written explicit custom code enabling the library's 'asynchronous authentication' mechanism and applied it to public-key or hostbased authentication. Apache rates this implementation choice as presumed rare, and servers that do not opt into asynchronous authentication - or that use it only with password or keyboard-interactive auth - are not exposed. No public exploit code has been identified at time of analysis and the vulnerability has not been confirmed as actively exploited (no CISA KEV listing).
SQL injection in Bytebase DBHub 1.2.0 allows unauthenticated remote attackers to submit crafted SQL statements that the /utils/sql-parser.ts component fails to classify correctly, bypassing the MCP server's parser-level read-only enforcement so the statement reaches the backend database and can expose sensitive database information. Only version 1.2.0 is confirmed affected, and there is no public exploit code identified at time of analysis and no CISA KEV confirmation of active exploitation; no EPSS score or vendor-published fix version was present in the available intelligence. The vendor rates this Critical (CVSS 9.1, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), whereas independent assessment places the confidentiality impact higher and integrity/availability lower (C:H/I:L/A:L), and notes that real-world exposure is substantially reduced where the DBHub MCP server is run locally or behind a trusted MCP client rather than being network-reachable.
MetaMCP through 2.4.22 leaks live MCP session identifiers and namespace UUIDs from its unauthenticated GET /metamcp/health/sessions endpoint, and because the session store is keyed solely on the client-supplied mcp-session-id header, an unauthenticated remote attacker can replay a stolen ID to impersonate another tenant's transport session. The attacker can then enumerate and execute the victim tenant's private MCP tools and exfiltrate data using the credentials the victim has forwarded to those tools, rated CVSS 3.1 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, CWE-639). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but all exploitability signals - unauthenticated network reach, no user interaction, and a directly replayable session credential - indicate genuine high risk for multi-tenant deployments exposed to untrusted networks.
Arbitrary code execution in Das U-Boot allows an unauthenticated attacker on the adjacent network segment to hijack the bootloader by replaying duplicated last-fragment IPv4 packets against stale IP reassembly state. Only builds compiled with the non-default CONFIG_IP_DEFRAG=y option and actively using U-Boot's network stack (for example TFTP or PXE netboot) are exposed, and the attacker must hit the narrow boot-time window while the bootloader is running, so the practical attack surface is narrower than the CVSS 9.0 base score implies. No public exploit code was identified and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; the vendor has released a fix in version 2026.07 (commit b1aec609bb5e0d08c25c888c91935287ab4ee5fa).
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrate local files readable by the Joomla process via crafted upload-field JSON during public form submission. The flaw requires that the target form has both the 'auto reply' and 'attach uploaded files' options enabled, limiting exploitability but still posing high risk given the CVSS 4.0 score of 8.9 and no authentication or user interaction required. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Unbounded memory allocation in urllib3 (1.10.3 through 2.7.x) lets a malicious or machine-in-the-middle HTTP server exhaust the memory of a Python client process by streaming an unterminated chunk-size line in a 'Transfer-Encoding: chunked' response. Only clients that consume the response through the streaming path (HTTPResponse.stream() or HTTPResponse.read_chunked()) are affected; the non-streaming .read() path was already bounded to http.client._MAXLINE. Exploitation is unauthenticated (CVSS:4.0 vector PR:N, assessed CVSS:3.1 PR:N) but requires the client to reach an attacker-controlled or intercepted endpoint, so SSRF-prone, proxy, crawler, and webhook-fetching services are the realistic exposure; impact is denial of service only (C:N/I:N/A:H, no RCE), and no public exploit identified at time of analysis.
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-privileged attacker to make the server issue requests to arbitrary URLs via improperly validated URLs in various core extensions. Exploitation requires a backend or administrator account and is not achievable by anonymous users; high attack complexity means a single reliable request is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated attacker who can influence security policy alert text execute arbitrary operating system commands with root privileges through the SNMP alert notification functionality. Exploitation is gated behind valid credentials with policy-authoring capability and requires that the deployment actually uses SNMP alerting, so this is a privileged-insider or compromised-account risk rather than an opportunistic remote attack; no public exploit code was identified at time of analysis and CISA SSVC records no known exploitation. IBM has published a vendor patch, and the EPSS score is low (0.67%, ~50th percentile), consistent with a credible high-impact issue that is not an emergency.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw in its archive extraction routine that lets a remote attacker with a valid authenticated account write files outside the intended destination directory and ultimately execute arbitrary code with the privileges of the affected service (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). The root cause is CWE-22 improper limitation of a pathname to a restricted directory, commonly known as an archive 'zip-slip' condition, where crafted entries in an uploaded archive escape the extraction root. Authentication is mandatory, so this is not an unauthenticated flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated in enterprise Cloud Pak for Data deployments where the attacker already holds platform credentials or a foothold.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by processing attacker-controlled SPDY protocol data, an availability-only denial-of-service condition that our independent assessment scores as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The signals conflict and, on balance, point to a LOWER real-world priority than the headline 8.8 suggests: exploitation requires the victim to open a crafted capture file or live-capture crafted SPDY traffic, publicly available exploit code exists, EPSS is only 0.45% (37th percentile), and there is no confirmed active exploitation (CISA KEV). Unauthenticated attackers can trigger the crash, but user interaction is mandatory and the impact is limited to terminating the Wireshark process, not code execution or data compromise.
Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.
Memory corruption in U-Boot's IP fragment reassembly code (net/net.c) allows remote, unauthenticated attackers on the boot network to crash the bootloader and corrupt adjacent memory while a device is performing a netboot. Only builds compiled with CONFIG_IP_DEFRAG are affected - an opt-in, frequently disabled compile option - so deployments without it are not vulnerable, and exploitation requires delivering a crafted IP fragment with a non-zero offset and the More-Fragments flag onto the boot path during the narrow netboot window. The CVSS 4.0 base score is 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H), an availability-dominant flaw with only limited integrity impact and no confidentiality loss, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.
Memory corruption in U-Boot’s NFS READLINK handling can crash the bootloader on devices booting over NFS. A malicious or man-in-the-middle NFS server can return a crafted symlink length that triggers a signed-to-unsigned conversion error (CWE-195) and out-of-bounds access in nfs_readlink_reply(), affecting U-Boot versions before 2026.10-rc5; the vendor CVSS 4.0 base score is 8.8. Exploitation requires the device to be actively performing an NFS netboot and reaching the attacker-controlled server, so idle or non-NFS-boot devices are unaffected, and no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Use-after-free in the DOM: Core & HTML engine of Mozilla Firefox allows memory corruption that can be driven by attacker-controlled web content, potentially yielding code execution or memory disclosure inside the browser's content process. Affected are Firefox releases before 157 and the ESR branches before 153.4, 140.17, and 115.42; exploitation only requires that the victim load a malicious or compromised page (UI:R) with no authentication and no non-default settings, since the DOM Core/HTML code path is always active. Mozilla has published fixed versions and no public exploit was identified at time of analysis, and the achievable impact is bounded by Firefox's content-process sandbox unless chained with a separate escape.
Use-after-free in Mozilla Firefox's XSLT engine lets a remote, unauthenticated attacker corrupt memory by getting a victim to render attacker-controlled content that performs an XSL transformation, with the assessed CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflecting high confidentiality, integrity, and availability impact. The flaw affects Firefox builds before 157 and ESR builds before 153.4, 140.17, and 115.42, and is remediated in those releases. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); the main practical barrier is the mandatory user interaction, since the victim must visit or render the malicious content for the XSLT path to execute.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D rendering component allows a remote, unauthenticated attacker to corrupt browser memory and potentially achieve arbitrary code execution when a victim loads crafted web content in an unpatched build. Exploitation hinges on user interaction - the victim must open a malicious or compromised page that exercises the Canvas2D path - and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality, integrity, and availability impact confined to the browser process by the renderer sandbox. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), making this a serious client-side bug rather than an emergency; vendor-released fixes are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
Memory corruption in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger a use-after-free when a victim loads attacker-controlled web content, potentially leading to arbitrary code execution, information disclosure, or crashes. Affected versions include Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42; the flaw is patched in those fixed releases. Exploitation requires user interaction in default browsing and must contend with Firefox sandboxing and heap-hardening mitigations; no public exploit identified at time of analysis (no CISA KEV confirmation).
A use-after-free in Firefox's Layout: Text and Fonts component lets remote attackers corrupt memory by enticing a victim to open crafted web content, potentially leading to code execution within the browser's content process. Unauthenticated network attackers can trigger it with low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) confirms a successful attack requires user interaction and no privilege is needed beforehand. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; there is no CISA KEV entry and no public exploit identified at time of analysis, though the memory-corruption class makes weaponization plausible.
A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.
A use-after-free in Mozilla Firefox's XSLT (XML stylesheet transformation) engine can be triggered when a victim loads attacker-controlled content that exercises stylesheet processing, allowing memory corruption that jeopardizes confidentiality, integrity, and availability of the browser session. The flaw affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires no privileges (PR:N) but does require user interaction (UI:R) - the target must open a malicious page or XML document, with no zero-click or server-side path indicated by the available data. Mozilla has released fixed versions across all supported release and ESR channels; no public exploit code was identified at time of analysis.
Use-after-free in the Graphics: Canvas2D component of Mozilla Firefox allows remote, unauthenticated attackers to corrupt browser memory when a victim renders attacker-controlled web content - a malicious page, ad, or iframe provides the required user interaction (UI:R). Successful exploitation can expose or modify memory (high C/I/A impact per the 8.8 CVSS), causing crashes and potentially arbitrary code execution inside the content/renderer process, although turning the primitive into reliable code execution also requires defeating Firefox's site isolation, sandbox, and ASLR hardening, which keeps practical difficulty above the raw score. Only unpatched builds are affected; Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42 carry the fix, and no public exploit code or active exploitation was identified at the time of analysis.
Use-after-free in Mozilla Firefox's DOM: Core & HTML implementation lets remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content in an unpatched build. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is network-reachable and low-complexity and requires no authentication, but does depend on user interaction - the victim must open a malicious or compromised page. Every supported channel is affected prior to the fixed releases (Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42); there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though successful heap grooming of the freed DOM object can escalate beyond a crash within the constraints of Firefox's sandbox and mitigations.
Use-after-free in Mozilla Firefox's IndexedDB storage implementation allows a remote, unauthenticated attacker to execute arbitrary code with the victim's privileges by convincing them to load attacker-controlled web content that exercises the IndexedDB API. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact, with the only meaningful barrier being the required user interaction - no authentication or non-default configuration is needed. Mozilla fixed the flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; no public exploit code or confirmed active exploitation was identified at time of analysis, but given Firefox's enormous install base and the browser-context code execution primitive, this warrants priority patching rather than emergency escalation.
Mozilla Firefox builds prior to version 157, along with the ESR branches prior to 153.4, 140.17, and 115.42, contain a use-after-free in the Networking: Cache component that lets a remote attacker corrupt memory by persuading a victim to render attacker-controlled web content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is the classic browser drive-by profile: no authentication is required, complexity is low, but exploitation depends on the user navigating to or loading a malicious page that reaches the specific cache code path, and the content-process sandbox limits how far a single use-after-free can be pushed toward full system compromise. The flaw is patched in Firefox 157 and Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no CISA KEV listing and no public exploit code were identified at time of analysis, so this is a patch-now, high-severity memory-safety bug rather than a confirmed actively exploited one.
Use-after-free (CWE-416) in Mozilla Firefox's Widget component allows remote attackers to potentially execute arbitrary code when a victim renders attacker-controlled web content in unpatched versions (before Firefox 157, Firefox ESR 153.4, ESR 140.17, or ESR 115.42). Successful exploitation requires reliable heap manipulation and depends on the user opening malicious content (UI:R), but can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Arbitrary code execution inside the renderer sandbox can be achieved by a remote attacker who lures a Google Chrome user, on any build prior to 154.0.8037.92, into loading a crafted HTML page that triggers a type confusion in the V8 JavaScript engine. No authentication or special privileges are required, but the victim must actively render attacker-controlled HTML/JavaScript (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), so exploitation is dependent on user interaction. Per the CISA SSVC evaluation exploitation is currently none and no public exploit code has been identified at time of analysis; the risk is driven instead by Chrome's enormous install base, the total technical impact rating, and the fact that any resulting code execution stays confined to the renderer sandbox - full host compromise would require chaining a separate sandbox-escape vulnerability. Google classifies the issue as High severity and a vendor patch is available.
Memory corruption in the U-Boot bootloader's NFS client lets a malicious or man-in-the-middle NFS server overflow the packet buffer in nfs_read_reply(), crashing the bootloader or corrupting memory before control is handed to the kernel. Affected are U-Boot builds prior to 2026.10-rc5 that perform NFS netboot (CPE cpe:2.3:a:u-boot:u-boot:*); the flaw is reachable by an unauthenticated network attacker (CVSS vector PR:N), though per our assessment the practical outcome is a boot-time denial of service with limited integrity impact rather than confirmed code execution, since the device must be actively NFS-booting and the attacker must control or intercept the NFS server on the boot network. A vendor patch exists (commit 0bbf0985, fixed in 2026.10-rc5) and no public exploit code was identified at time of analysis.
A use-after-free in Mozilla Firefox's WebAssembly component allows remote attackers to potentially execute arbitrary code by enticing a victim to visit a malicious web page. The vulnerability affects Firefox versions before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; no authentication or non-default configuration is required, but exploitation requires user interaction (UI:R). No public exploit code or active exploitation has been identified at time of analysis, and browser process sandboxing limits the impact.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component (CWE-416) lets remote attackers achieve full confidentiality and integrity impact against unpatched Firefox builds when a victim simply loads attacker-controlled web content, matching the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Firefox versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17; exploitation needs no authentication or non-default configuration, and the mandatory browsing/user interaction is the primary limiting factor. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but Mozilla has shipped fixed builds, so prioritization should focus on unpatched endpoints in browser-exposed or high-value user populations.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly component lets remote attackers corrupt memory and potentially achieve code execution or disclose sensitive data when a user loads attacker-controlled web content containing a malicious WebAssembly payload. The flaw affects default Firefox configurations up to Firefox 157 and the ESR branches-Firefox ESR 153.4 and Firefox ESR 140.17 are the first fixed releases-and requires no authentication, only that the victim browse a crafted page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a genuine but not top-tier priority; exploitation is client-side and requires user interaction, and because scope is unchanged the initial impact is confined to the content process unless chained with a separate sandbox-escape bug.
Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.
Type confusion in the V8 JavaScript engine in Google Chrome prior to 154.0.8037.92 lets remote attackers execute arbitrary code inside the renderer sandbox by luring a victim into opening a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction - the victim must render the attacker's page - and because V8 runs JavaScript on essentially every page, default desktop configurations are exposed. Impact is scored 8.8 High (C:H/I:H/A:H) with the important caveat that code execution is confined to the sandbox, so full host compromise requires chaining a separate sandbox-escape bug; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available as Chrome 154.0.8037.92.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly engine enables remote code execution or memory corruption when a victim views a malicious webpage, requiring only that the user loads attacker-controlled content (UI:R) with no authentication (PR:N). The flaw affects all Firefox versions prior to 157 and Firefox ESR prior to 153.4, and is rated CVSS 8.8 due to high confidentiality, integrity, and availability impact; the content-process sandbox (S:U) limits impact to the browser process absent a separate escape. No public exploit identified at time of analysis, and no CISA KEV listing; Mozilla has released patches in Firefox 157 and Firefox ESR 153.4.
A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.
A use-after-free in U-Boot's lwIP-based wget HTTP client lets an attacker who controls (or MITMs) the server a device downloads from crash the bootloader during a netboot/provisioning fetch, interrupting boot. The bug sits in the httpc_recv_cb() receive callback: when HTTP data storage fails, it frees the connection's protocol control block but returns ERR_BUF instead of ERR_ABRT, so the TCP input path continues on released memory. All U-Boot versions before 2026.10-rc5 are affected; the CVSS 4.0 vector scores 8.8 (AV:N/AC:L/PR:N/UI:N, VA:H, VI:L) and our independent CVSS 3.1 assessment rates it 7.5 as an availability-dominant issue - no public exploit identified at time of analysis, and impact is limited to a bootloader crash rather than code execution or data exposure.
Use-after-free in Mozilla Firefox's WebAssembly engine (JavaScript/SpiderMonkey component) allows an unauthenticated remote attacker to corrupt browser memory and potentially achieve code execution against users running Firefox versions prior to 157. Exploitation requires the victim to open attacker-controlled web content that exercises a crafted WebAssembly module (UI:R), and while no public exploit code has been identified at time of analysis and the issue is not on CISA KEV, the CVSS 3.1 base score of 8.8 with C:H/I:H/A:H reflects a full high-impact memory-corruption outcome typical of an RCE-class heap use-after-free. Users on Firefox 157 or later are not affected.
Use-after-free in Mozilla Firefox's Graphics: WebGPU component allows remote attackers to corrupt memory and potentially achieve code execution or read sensitive data when a victim loads attacker-controlled web content that exercises the WebGPU API; the flaw is fixed in Firefox 157. Exploitation is gated by user interaction (CVSS PR:N, UI:R) and by WebGPU being reachable in the victim's build, and no public exploit code or confirmed active exploitation has been identified at time of analysis. The 8.8 CVSS score reflects high confidentiality and integrity impact within the affected browsing process, though the content-process sandbox typically limits standalone impact unless chained with a sandbox escape.
Boundary-condition errors in Mozilla Firefox's Graphics component allow an unauthenticated remote attacker to trigger memory corruption and achieve privilege escalation on the affected platform, provided the victim loads attacker-controlled content that reaches the vulnerable rendering code path. Only builds below Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 are affected - updating to any of those versions fully remediates the issue. Although the CVSS base score is 8.8 with high confidentiality, integrity, and availability impact, no public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' and the flaw as not automatable, and the mandatory user-interaction requirement (UI:R) prevents automated or wormable spread, making this a genuine but not top-priority issue.
Use-after-free in Mozilla Firefox's Graphics: WebRender compositor lets remote, unauthenticated attackers corrupt memory and escalate privileges inside the browser when a victim loads attacker-controlled web content - no authentication is required (PR:N), but the attack is not server-side passive and depends on the target visiting or interacting with a malicious or compromised page (UI:R). The flaw rates CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was fixed in Firefox 157 and in Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no public exploit code has been identified and CISA's SSVC assessment records exploitation as none, so this is a genuine but not urgent priority. Modern Firefox content-process sandboxing further limits post-corruption impact unless the attacker chains a separate sandbox escape, and WebRender is enabled by default, so no unusual configuration is needed to reach the vulnerable path.
Memory corruption in Mozilla Firefox ESR's Graphics: Canvas2D component allows remote attackers to execute code within the browser content process when a victim is induced to load attacker-controlled web content; the root cause is a use-after-free (CWE-416) rated CVSS 3.1 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting full confidentiality, integrity, and availability loss inside the exploited process. Affected builds are ESR 115.x before 115.42, ESR 140.x before 140.17, and ESR 153.x before 153.4, with vendor fixes released in Firefox ESR 115.42, 140.17, and 153.4. Exploitation requires victim interaction (loading a malicious or compromised page) and is unauthenticated over the network (PR:N); no public exploit code was identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' with 'no' automatable applicability and total technical impact.
Remote code execution in Mozilla Firefox's SpiderMonkey JavaScript JIT engine allows unauthenticated attackers to corrupt memory via crafted web content, potentially leading to arbitrary code execution within the browser's content process. Exploitation requires the victim to visit or be redirected to a malicious page (UI:R) that triggers incorrect boundary conditions during JIT compilation; JIT is enabled by default, so no special victim configuration is needed. No public exploit code or active exploitation has been identified at time of analysis, but the flaw is near-critical due to the high-value JIT attack surface. Fixed in Firefox 157 and Firefox ESR 153.4.
Use-after-free in Mozilla Firefox's DOM UI Events and Focus Handling code allows a remote, unauthenticated attacker to corrupt the browser's heap and potentially achieve code execution in the content process when a victim loads attacker-controlled web content. The flaw affects Firefox builds before 157 and Firefox ESR before 153.4, where it has been fixed; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with the mandatory user interaction (opening the page) being the primary precondition, and CISA's SSVC assessment does not consider it automatable. No public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so despite the high base score this reads as a medium-priority memory-corruption flaw in an ubiquitous browser rather than an emergency, actively exploited issue.
Privilege escalation in the Mozilla Firefox Address Bar component lets a remote, unauthenticated attacker gain elevated privileges within the browser by persuading a victim to load and interact with attacker-controlled web content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) confirms no credentials are needed but the attack cannot succeed without the targeted user interacting with the malicious page, and CISA's SSVC assessment marks the issue as not automatable with no observed exploitation. No public exploit code or confirmed active exploitation has been identified at time of analysis; the flaw is remediated in Firefox 157, Firefox ESR 153.4, and Firefox ESR 140.17, so only unpatched installations prior to those builds remain exposed.
Privilege escalation in Mozilla Firefox's DOM: Service Workers component allows a remote, unauthenticated attacker (CVSS vector PR:N) to elevate privileges inside the browser after convincing a victim to visit an attacker-controlled or compromised page (UI:R), affecting Firefox builds before 157 and ESR branches before 153.4 and 140.17. The 8.8 score derives from high confidentiality, integrity, and availability impact with low attack complexity, but scope is unchanged (S:U), meaning the impact stays confined to the browser's own privilege boundary rather than escaping to the host operating system. There is no public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as none and automatable as no, so practical exposure is driven by how quickly the supplied ESR/rapid-release fixes are deployed rather than by observed attack activity.