Invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Sandbox escape in the Form Manager component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Information disclosure due to uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Privilege escalation due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, and Firefox ESR 153.6.
Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 159 and Firefox ESR 153.6.
Input validation bypass in dcmjs (npm package `dcmjs`) before 0.52.0 allows unauthenticated attackers to force Infinity or NaN into parsed DICOM DS (Decimal String) and IS (Integer String) numeric values by supplying scientific-notation overflow such as '1e999999' or a sign-only remnant produced when '-inf' is sanitized down to '-'. The corrupted numbers only cause harm where the downstream consumer - OHIF Viewer, Cornerstone.js or another DICOMweb pipeline built on dcmjs - fails to range-check parsed values, which the maintainer notes callers are expected to do regardless, so the practical severity depends on the host application rather than on dcmjs alone. Realistic outcomes are corrupted spatial geometry, windowing, rescale and dosimetry values, or frame-count overflow; no public exploit was identified at time of analysis and this CVE is not in CISA KEV, with the maintainer rating it low versus the reporter's 7.5 assessment.
Wails v2's BindingsAllowedOrigins wildcard matching can be bypassed when an application is configured with a trailing or partial-label wildcard such as https://myapp.com*, allowing an attacker-controlled origin sharing that literal prefix, for example myapp.community or myapp.com.attacker.com, to invoke bound Go methods once that origin is loaded in the webview. The documented subdomain-prefix pattern https://*.myapp.com and default configurations without such a wildcard are not affected, and realized impact depends on which Go methods the application exposes. The vendor rates this 7.6 HIGH under CVSS 4.0; no public exploit identified at time of analysis and no CISA KEV listing, and exploitation requires the non-default misconfiguration plus user/webview interaction to load the attacker origin.
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.
An issue in Shirt Pocket's SuperDuper! 4.0.9 and earlier allow a local attacker to obtain sensitive information