Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Sandbox escape due to use-after-free in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
Sandbox escape due to incorrect boundary conditions in the Storage: Cache API component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
CVE-2026-124855 is a sandbox escape vulnerability in the DOM Navigation component of Mozilla Firefox. This flaw allows code running in a restricted environment to break out of the sandbox, potentially leading to elevated privileges or unauthorized actions. The issue was fixed in Firefox 160 and Firefox ESR 153.7.
CVE-2026-124854 is a privilege escalation vulnerability in the DOM Navigation component of Mozilla Firefox. It was fixed in Firefox 160 and Firefox ESR 153.7. The vulnerability allows an attacker to escalate privileges within the browser context, potentially leading to unauthorized actions. The issue was assigned a high impact rating by Mozilla.
Sandbox escape due to incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.
A threat actor exploited compromised IAM credentials associated with Qubole's AWS account to access and steal data from over a dozen organizations. The attackers assumed cross-account IAM roles that were still active despite some companies no longer using Qubole, allowing them to enumerate resources, collect secrets, and exfiltrate data from AWS S3 buckets. The campaign occurred between October 14 and October 26, 2026, and involved opportunistic data theft rather than targeted espionage. No evidence was found of deployment of a discovered ISO file designed for remote data harvesting. A separate related campaign tested customer-owned AWS keys for compromise between October 8 and 11, 2026. The attack originated from rented servers and VPNs, not Qubole's network.
CVE-2026-82509 is a critical vulnerability in the V programming language standard library net.http up to version 0.5.2. It involves improper TLS certificate validation due to default configuration settings that disable certificate verification in both mbedtls and OpenSSL backends. This allows on-path attackers to intercept or modify HTTPS traffic by presenting invalid certificates such as expired, self-signed, or wrong-hostname certificates. The vulnerability affects functions like http.get, http.post, and http.fetch unless the validate option is explicitly set to true.
Summary
Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3 DATAGRAM handling. For every previously unseen flow identifier (quarter stream ID) received in a DATAGRAM frame, tokio-quiche creates and retains new, per-flow state. A remote peer can send DATAGRAMs with many distinct identifiers, causing the per-connection flow map and associated channel state to grow without bound.
Impact
Exploitation can exhaust process memory and cause a denial of service. The vulnerable code is used in both client and server configurations, so either role can be affected by a malicious peer. QUIC DATAGRAM support in tokio-quiche is enabled by default through QuicSettings::enable_dgram; applications can disable it by setting this field to false. The vulnerable HTTP/3 path is reachable only when DATAGRAM support is negotiated with the peer. Core quiche and HTTP/3 deployments without DATAGRAM support are not affected.
Mitigation
Disable DATAGRAMs in tokio-quiche’s QuicSettings::enable_dgram.
Remediation
Upgrade to tokio-quiche version 0.23.0 or later. The fixed code creates flow state only for valid DATAGRAM-capable request streams, which are bounded by QUIC’s stream limits. To tolerate packet reordering, servers retain early DATAGRAMs in a bounded, expiring buffer, while clients discard DATAGRAMs for unknown flows.
The @erlanzz/baileys npm package version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library that covertly uses the installer's authenticated WhatsApp session to subscribe the account to specific WhatsApp Channels without user consent. This behavior inflates the publisher's channel subscribers by sending WhatsApp FOLLOW queries to predefined channel JIDs. The malicious code runs when an application creates a WhatsApp socket with the library and does not send credentials off-host or persist beyond runtime.
Red Hat has issued a security advisory for subscription-manager-cockpit addressing two vulnerabilities in the lodash library: CVE-2026-4800, which allows arbitrary code execution via untrusted input in template imports, and CVE-2026-2950, which permits prototype pollution enabling deletion of built-in prototype properties via an array path bypass. These vulnerabilities affect Red Hat Enterprise Linux 10 across multiple architectures. The update is rated as Important by Red Hat Product Security.
CVE-2026-124747 is a heap-based buffer overflow vulnerability in BusyBox's wget utility when resuming FTP downloads. The flaw occurs because wget does not verify that the resume offset exceeds the file size reported by the FTP server, leading to an integer calculation error. Exploitation requires interaction with a malicious or compromised FTP server or an on-path attacker manipulating file size metadata. Successful exploitation may allow arbitrary code execution or cause application crashes (DoS). In Red Hat Enterprise Linux 6, BusyBox is not a standard core utility and is mainly used in specialized container and boot images, limiting exposure. No official fix or mitigation meeting Red Hat's criteria is currently available.