Monthly
Authorization bypass in the Sentry Next.js SDK affects @sentry/nextjs from 9.36.0 before 9.47.2, 10.x before 10.75.2, and 11.0.0-rc.1 when the webpack integration is used with a configured tunnelRoute. An unauthenticated remote request can reach an application route that collides with the tunnel path, or resolves through a root dynamic segment, without the middleware authorization that would otherwise run; exploitation additionally requires a webpack build, a colliding route, and middleware being the sole authorization control. The flaw is fixed in 9.47.2, 10.75.2, and 11.0.0-rc.1, and no public exploit was identified at time of analysis.
Enterprise Policies mitigation bypass in Mozilla Firefox allows an attacker-influenced page to circumvent administrator-enforced policies in managed browser deployments, resulting in high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Only fleets where Firefox is managed through the Enterprise Policies feature are meaningfully exposed - on a default, unmanaged installation there is no enforced policy to bypass - and the vector requires the victim to interact with attacker-controlled or attacker-influenced content, with no attacker authentication required. The issue is fixed in Firefox 158 and Firefox ESR 153.5; EPSS is low at 0.20% (9th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected enterprise-managed population makes timely patching worthwhile.
Protection-mechanism bypass in Mozilla Firefox's HTTP networking component lets remote, unauthenticated attackers defeat a built-in browser security mitigation when a victim loads attacker-controlled HTTP content, with high confidentiality and integrity impact (CVSS 8.1, C:H/I:H/A:N) but no availability impact. Exploitation requires user interaction (UI:R) and works only through drive-by or social-engineering delivery against an actively browsing user; the payoff depends on chaining the bypass to the very attack the mitigation was meant to stop. It is fixed in Firefox 158 and Firefox ESR 153.5, has no public exploit code or CISA KEV entry at time of analysis, and carries a low EPSS of 0.20% (9th percentile).
A sandbox escape in Mozilla Firefox's DOM Content Processes component lets a remote, unauthenticated attacker break out of the content-process sandbox if a victim merely renders attacker-controlled web content in any Firefox build prior to 158 (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the score is scope-changed, a successful escape grants impact outside the sandboxed content process - high confidentiality, integrity and availability effects on the host rather than on the page alone - but in practice the escape generally has to be paired with a separate content-process code-execution flaw to convert the boundary crossing into full code execution. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile), and the mandatory user interaction of loading the malicious page is the main practical constraint on real-world exploitation.
Mozilla Firefox prior to 158 contains a mitigation bypass in the DOM: Security component that lets remote attackers defeat a built-in browser protection, potentially enabling follow-on attacks the defense was designed to stop. The issue is rated CVSS 7.3 with low confidentiality, integrity, and availability impact; it is a defense-in-depth failure rather than direct code execution, and practical harm generally requires chaining with another vulnerability. Exploitation requires the victim to open attacker-controlled web content in an affected build, and no public exploit identified at time of analysis, with no CISA KEV activity and EPSS 0.20% (percentile 9%).
Mitigation bypass in Mozilla Firefox's Enterprise Policies component allows remote attackers who can get a victim to interact with crafted content to defeat policy-enforced security controls in managed deployments; the issue is fixed in Firefox 158 and Firefox ESR 153.5. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) no attacker privileges are needed but user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis and EPSS is low at 0.17% (6th percentile), so real-world exposure is concentrated in enterprise environments where Enterprise Policies are actually configured rather than in default consumer installs.
Mozilla Firefox before 158 and Firefox ESR before 153.5 contain a DOM Security mitigation bypass that allows remote attackers to defeat a browser-enforced protection mechanism when a victim loads attacker-controlled web content. The flaw is rated CVSS 8.1 (High) with high confidentiality and integrity impact, but requires user interaction (UI:R) and no public exploit code or active exploitation has been identified. EPSS is low at 0.20% (9th percentile).
Authenticated users with access to the MCP configuration interface in Nginx UI versions prior to 2.4.1 can bypass the directive filtering that the regular HTTP configuration API enforces, injecting restricted Nginx directives such as load_module, js_import, and js_content and then applying them via a configuration reload. Because the attacker can load the NJS module (ngx_http_js_module.so) and import JavaScript they control, they can execute arbitrary code inside the Nginx worker process, giving high impact to confidentiality, integrity, and availability of the managed Nginx instance. Exploitation requires a valid account (per the CVSS vector, PR:L, i.e. authenticated) and depends on the MCP interface being reachable and the Nginx build supporting NJS; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but it should be treated as high priority for any deployment below 2.4.1. The vendor-released patch is version 2.4.1, published with security advisory GHSA-5r62-gj48-897x.
Configuration-validation bypass in Nginx UI (versions 2.0.0-rc.6 through 2.4.0) lets an authenticated low-privilege user write arbitrary nginx configuration directives through the MCP tool nginx_config_add, which persists the file and triggers an nginx reload without ever calling config.ValidateConfigFile - the guard the REST endpoint POST /api/configs does invoke. Because blocked directives such as perl, js_import, load_module and user root can therefore be injected, an attacker on a host with the nginx Perl, njs or Lua module loaded can escalate this into post-authentication remote code execution; on hosts without a scripting module the effect is arbitrary config tampering and reload. The issue is fixed in Nginx UI 2.4.1, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Hex, the package manager used by Elixir and Erlang projects, fails to properly scope its 'release-age cooldown' protection in versions 2.5.0 through 2.5.1, allowing an authenticated package owner to slip a freshly published, malicious release past the cooldown. The attacker must already hold package-owner permission on the target package, retire (or rely on a security advisory for) the release locked in the victim's mix.lock, and then wait for the victim to run mix deps.update - at which point Hex.RemoteConverger.build_cooldown_bypass/3 and unsafe_lock_bypass/1 lift the cooldown for every version of that package and its dependencies, so the new release is selected regardless of age. A secondary scoping defect causes the bypass to be keyed on package name alone, extending it to identically named packages in other repositories; cooldown configured through an organization dependency policy is not affected. This is a conditional supply-chain weakness rather than a broadly dangerous remote flaw, and no public exploit or in-the-wild activity has been identified at time of analysis. Patches are available from the vendor in Hex 2.5.2.
Authorization bypass in the Sentry Next.js SDK affects @sentry/nextjs from 9.36.0 before 9.47.2, 10.x before 10.75.2, and 11.0.0-rc.1 when the webpack integration is used with a configured tunnelRoute. An unauthenticated remote request can reach an application route that collides with the tunnel path, or resolves through a root dynamic segment, without the middleware authorization that would otherwise run; exploitation additionally requires a webpack build, a colliding route, and middleware being the sole authorization control. The flaw is fixed in 9.47.2, 10.75.2, and 11.0.0-rc.1, and no public exploit was identified at time of analysis.
Enterprise Policies mitigation bypass in Mozilla Firefox allows an attacker-influenced page to circumvent administrator-enforced policies in managed browser deployments, resulting in high confidentiality and integrity impact (CVSS 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Only fleets where Firefox is managed through the Enterprise Policies feature are meaningfully exposed - on a default, unmanaged installation there is no enforced policy to bypass - and the vector requires the victim to interact with attacker-controlled or attacker-influenced content, with no attacker authentication required. The issue is fixed in Firefox 158 and Firefox ESR 153.5; EPSS is low at 0.20% (9th percentile) and no public exploit code or confirmed active exploitation was identified at time of analysis, though the affected enterprise-managed population makes timely patching worthwhile.
Protection-mechanism bypass in Mozilla Firefox's HTTP networking component lets remote, unauthenticated attackers defeat a built-in browser security mitigation when a victim loads attacker-controlled HTTP content, with high confidentiality and integrity impact (CVSS 8.1, C:H/I:H/A:N) but no availability impact. Exploitation requires user interaction (UI:R) and works only through drive-by or social-engineering delivery against an actively browsing user; the payoff depends on chaining the bypass to the very attack the mitigation was meant to stop. It is fixed in Firefox 158 and Firefox ESR 153.5, has no public exploit code or CISA KEV entry at time of analysis, and carries a low EPSS of 0.20% (9th percentile).
A sandbox escape in Mozilla Firefox's DOM Content Processes component lets a remote, unauthenticated attacker break out of the content-process sandbox if a victim merely renders attacker-controlled web content in any Firefox build prior to 158 (CVSS 3.1 9.6, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Because the score is scope-changed, a successful escape grants impact outside the sandboxed content process - high confidentiality, integrity and availability effects on the host rather than on the page alone - but in practice the escape generally has to be paired with a separate content-process code-execution flaw to convert the boundary crossing into full code execution. There is no confirmed active exploitation (the issue is not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.19% (8th percentile), and the mandatory user interaction of loading the malicious page is the main practical constraint on real-world exploitation.
Mozilla Firefox prior to 158 contains a mitigation bypass in the DOM: Security component that lets remote attackers defeat a built-in browser protection, potentially enabling follow-on attacks the defense was designed to stop. The issue is rated CVSS 7.3 with low confidentiality, integrity, and availability impact; it is a defense-in-depth failure rather than direct code execution, and practical harm generally requires chaining with another vulnerability. Exploitation requires the victim to open attacker-controlled web content in an affected build, and no public exploit identified at time of analysis, with no CISA KEV activity and EPSS 0.20% (percentile 9%).
Mitigation bypass in Mozilla Firefox's Enterprise Policies component allows remote attackers who can get a victim to interact with crafted content to defeat policy-enforced security controls in managed deployments; the issue is fixed in Firefox 158 and Firefox ESR 153.5. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) no attacker privileges are needed but user interaction is required, and successful exploitation yields high confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis and EPSS is low at 0.17% (6th percentile), so real-world exposure is concentrated in enterprise environments where Enterprise Policies are actually configured rather than in default consumer installs.
Mozilla Firefox before 158 and Firefox ESR before 153.5 contain a DOM Security mitigation bypass that allows remote attackers to defeat a browser-enforced protection mechanism when a victim loads attacker-controlled web content. The flaw is rated CVSS 8.1 (High) with high confidentiality and integrity impact, but requires user interaction (UI:R) and no public exploit code or active exploitation has been identified. EPSS is low at 0.20% (9th percentile).
Authenticated users with access to the MCP configuration interface in Nginx UI versions prior to 2.4.1 can bypass the directive filtering that the regular HTTP configuration API enforces, injecting restricted Nginx directives such as load_module, js_import, and js_content and then applying them via a configuration reload. Because the attacker can load the NJS module (ngx_http_js_module.so) and import JavaScript they control, they can execute arbitrary code inside the Nginx worker process, giving high impact to confidentiality, integrity, and availability of the managed Nginx instance. Exploitation requires a valid account (per the CVSS vector, PR:L, i.e. authenticated) and depends on the MCP interface being reachable and the Nginx build supporting NJS; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited, but it should be treated as high priority for any deployment below 2.4.1. The vendor-released patch is version 2.4.1, published with security advisory GHSA-5r62-gj48-897x.
Configuration-validation bypass in Nginx UI (versions 2.0.0-rc.6 through 2.4.0) lets an authenticated low-privilege user write arbitrary nginx configuration directives through the MCP tool nginx_config_add, which persists the file and triggers an nginx reload without ever calling config.ValidateConfigFile - the guard the REST endpoint POST /api/configs does invoke. Because blocked directives such as perl, js_import, load_module and user root can therefore be injected, an attacker on a host with the nginx Perl, njs or Lua module loaded can escalate this into post-authentication remote code execution; on hosts without a scripting module the effect is arbitrary config tampering and reload. The issue is fixed in Nginx UI 2.4.1, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Hex, the package manager used by Elixir and Erlang projects, fails to properly scope its 'release-age cooldown' protection in versions 2.5.0 through 2.5.1, allowing an authenticated package owner to slip a freshly published, malicious release past the cooldown. The attacker must already hold package-owner permission on the target package, retire (or rely on a security advisory for) the release locked in the victim's mix.lock, and then wait for the victim to run mix deps.update - at which point Hex.RemoteConverger.build_cooldown_bypass/3 and unsafe_lock_bypass/1 lift the cooldown for every version of that package and its dependencies, so the new release is selected regardless of age. A secondary scoping defect causes the bypass to be keyed on package name alone, extending it to identically named packages in other repositories; cooldown configured through an organization dependency policy is not affected. This is a conditional supply-chain weakness rather than a broadly dangerous remote flaw, and no public exploit or in-the-wild activity has been identified at time of analysis. Patches are available from the vendor in Hex 2.5.2.