CVE-2026-100811 is a critical use-after-free vulnerability in the DOM Core & HTML component of Mozilla Thunderbird that allows sandbox escape. This flaw has been fixed in Thunderbird versions 140.17, 153.4, and 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Users should update to the fixed versions to mitigate the risk.
CVE-2026-100803 is a high-severity vulnerability in Mozilla Firefox involving a same-origin policy bypass in the WebExtensions component. This flaw allows an attacker to bypass security restrictions that normally prevent web content from accessing data from other origins. The issue has been fixed in multiple Mozilla products including Firefox ESR 153.4, Firefox 157, Thunderbird 140.17, 153.4, and 157, as well as Firefox ESR 115.42 and 140.17.
CVE-2026-100797 is a high-severity privilege escalation vulnerability in Mozilla Firefox caused by a use-after-free flaw in the Graphics: WebRender component. This issue allows an attacker to escalate privileges by exploiting memory corruption. The vulnerability has been fixed in multiple Mozilla products, including Firefox ESR 153.4, Firefox 157, and Thunderbird versions 140.17, 153.4, and 157.
CVE-2026-96869 is an information disclosure vulnerability in the Networking component of Mozilla Thunderbird. It allows unauthorized information exposure but does not impact integrity or availability. The issue has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as corresponding Firefox versions.
CVE-2026-100794 is a critical vulnerability in Mozilla Thunderbird involving a sandbox escape caused by incorrect boundary conditions in the Internationalization component. This flaw allows an attacker to bypass sandbox protections, potentially leading to full compromise of confidentiality, integrity, and availability. The issue has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as Firefox ESR 140.17, ESR 153.4, and Firefox 157.
CVE-2026-100792 is a high-severity vulnerability in Mozilla Thunderbird involving a JIT miscompilation issue in the JavaScript WebAssembly component. This flaw could lead to high confidentiality impact and limited integrity impact without affecting availability. The vulnerability has been fixed in Thunderbird versions 140.17, 153.4, and 157, as well as corresponding Firefox versions. No known exploits are reported in the wild.
CVE-2026-100791 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. This vulnerability allows for potential high impact on confidentiality, integrity, and availability. It was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
CVE-2026-100788 is a critical vulnerability in Mozilla Thunderbird involving an invalid pointer in the JavaScript WebAssembly component. This flaw allows for potential high impact on confidentiality, integrity, and availability. The issue has been fixed in multiple versions of Thunderbird and Firefox, including Thunderbird 157, 140.17, and 153.4. The vulnerability is tracked under CWE-824 and has a CVSS score of 9.8, indicating critical severity.
A use-after-free vulnerability exists in the XSLT component of Mozilla Firefox and Thunderbird. This flaw allows for potential remote code execution due to improper memory handling. The issue has been addressed and fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
CVE-2026-100778 is a critical use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox and Thunderbird. It allows sandbox escape, potentially leading to complete compromise of confidentiality, integrity, and availability. The issue is fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
CVE-2026-100770 is a critical use-after-free vulnerability in the DOM Content Processes component of Mozilla Firefox that allows sandbox escape. This flaw was addressed and fixed in multiple Mozilla products including Firefox ESR 153.4, Firefox 157, and Thunderbird versions 140.17, 153.4, and 157. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17.
CVE-2026-100756 is a high-severity vulnerability in Mozilla Firefox and Thunderbird related to incorrect boundary conditions in the Audio/Video playback component. This flaw could lead to high impact on confidentiality and integrity. The issue has been fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, Firefox ESR 140.17, Thunderbird 157, Thunderbird 140.17, and Thunderbird 153.4.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
Axios versions from 1.17.0 up to but not including 1.20.0 have a vulnerability in the fetch adapter where the maxRedirects: 0 setting is bypassed. This causes the underlying fetch implementation to follow redirects even when redirects are disabled, potentially allowing redirected requests to access internal responses or state-changing internal endpoints. The issue is fixed in version 1.20.0.
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.
CVE-2026-54674 is an OS command injection vulnerability in FreePBX's security-reporting component affecting versions prior to 16.0.39 and 17.0.7. Authenticated users with access to the User Control Panel (UCP) can execute arbitrary commands as the webserver user due to insufficient sanitization of URL parameters. This vulnerability requires authenticated UCP access, which is more commonly granted to less-privileged users than to administrators. The issue has been addressed in FreePBX versions 16.0.39 and 17.0.7.