CVE-2026-117871 is a high-impact vulnerability involving an invalid pointer in the Graphics component of Mozilla Firefox. This flaw was addressed and fixed in Firefox version 159 and Firefox ESR 153.6. The vulnerability is part of a set of memory safety issues resolved in this release cycle.
CVE-2026-117870 is a use-after-free vulnerability in the JavaScript Engine component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 159 and the corresponding Firefox ESR versions 115.44 and 153.6. The vulnerability has a high impact rating according to the Mozilla advisory. There are no known exploits in the wild for this issue as of the advisory date.
CVE-2026-117869 is a use-after-free vulnerability in the DOM: Core & HTML component of Mozilla Firefox. This vulnerability was addressed and fixed in Firefox version 159, Firefox ESR 115.44, and Firefox ESR 153.6. The issue could potentially lead to memory corruption and security risks if exploited.
CVE-2026-117868 is a high-impact sandbox escape vulnerability in the DOM Networking component of Mozilla Firefox. It allows an attacker to break out of the browser's sandbox environment, potentially leading to unauthorized actions beyond the browser's intended security boundaries. This vulnerability was fixed in Firefox 159 and corresponding ESR releases.
CVE-2026-117867 is a use-after-free vulnerability in the Layout component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 159 and Firefox ESR versions 115.44 and 153.6. The vulnerability is classified with high impact by Mozilla, indicating it could potentially lead to serious security consequences if exploited.
CVE-2026-117866 is a high-impact privilege escalation vulnerability caused by a use-after-free flaw in the Graphics: Canvas2D component of Mozilla Firefox. This vulnerability allows an attacker to escalate privileges within the browser environment. The issue was addressed and fixed in Firefox 159 and Firefox ESR versions 115.44 and 153.6.
CVE-2026-117865 is a use-after-free vulnerability in the JavaScript garbage collection (GC) component of Mozilla Firefox. This security flaw was addressed and fixed in Firefox version 159 and Firefox ESR 153.6. The vulnerability has been assigned a high impact rating by Mozilla. There are no known exploits in the wild at this time.
CVE-2026-117864 is a sandbox escape vulnerability in the Form Manager component of Mozilla Firefox. This security flaw allows an attacker to break out of the sandbox environment, potentially leading to unauthorized actions outside the restricted context. The vulnerability was addressed and fixed in Firefox version 159 and Firefox ESR 153.6. The impact of this vulnerability is rated as high by Mozilla.
CVE-2026-117863 is an information disclosure vulnerability caused by uninitialized memory in the Audio/Video component of Mozilla Firefox. This flaw could potentially allow sensitive information to be exposed. The vulnerability was fixed in Firefox 159 and the corresponding ESR releases 115.44 and 153.6.
CVE-2026-117862 is a privilege escalation vulnerability in the Networking component of Mozilla Firefox. It arises from incorrect boundary conditions that could allow an attacker to gain elevated privileges. This issue has been fixed in Firefox 159 and Firefox ESR versions 115.44 and 153.6.
CVE-2026-117861 is a high-impact vulnerability in Mozilla Firefox's DOM Navigation component that allows sandbox escape. This security flaw was addressed and fixed in Firefox version 159 and Firefox ESR 153.6. The vulnerability could potentially allow an attacker to break out of the browser's sandbox environment, increasing the risk of unauthorized code execution or access to restricted resources.
CVE-2026-117860 is a same-origin policy bypass vulnerability in the DOM Navigation component of Mozilla Firefox. This security flaw could allow an attacker to bypass browser security restrictions related to the same-origin policy. The issue was fixed in Firefox version 159 and Firefox ESR 153.6. The vulnerability is rated with high impact by Mozilla.
CVE-2026-117504 is a denial of service vulnerability in the a2aproject a2a-go software affecting versions 2.0 through 2.4.0. The flaw exists in the Cancel function of the Distributed Manager component, allowing remote attackers to cause a denial of service. Upgrading to version 2.5.0 resolves the issue.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 8.9.0.0 and corresponding LTS releases.
CVE-2026-117503 is a resource consumption vulnerability in the a2aproject a2a-go software affecting versions 2.0 through 2.4.0. The flaw exists in an unknown function within the REST SSE handler component (a2asrv/rest.go). This vulnerability can be exploited remotely to cause excessive resource usage. Upgrading to version 2.5.0 addresses the issue.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and specific LTS releases contain a relative path traversal vulnerability in the certificate handling component. This flaw allows a highly privileged remote attacker to potentially cause a denial of service. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact. Fixed versions are available starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 or later.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-28). This flaw allows a high privileged local attacker to potentially cause a denial of service. The vulnerability is fixed in versions 8.9.0.0 or later and corresponding later LTS releases.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a relative path traversal vulnerability (CWE-23). This flaw allows a high privileged remote attacker to potentially tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. Fixed versions are available starting from 8.9.0.0 and specific LTS patch levels.
Agno versions prior to 2.3.24 contain a critical arbitrary code execution vulnerability due to unsafe use of Python's eval() on the field_type parameter in FunctionCall inputs. This flaw allows attackers who can influence field_type to execute arbitrary Python code within the Agno process, impacting confidentiality, integrity, and availability. The vulnerability is fixed in version 2.3.24 and later. No safe workaround exists other than upgrading or ensuring no untrusted input reaches the vulnerable parameter.
A leaked SquareML access key potentially exposed personal and health information of 238,000 Denver Health Medical Plan members. The key was publicly accessible from June 27, 2025, until it was revoked on August 18, 2026. The compromised account was read-only, limiting the ability to alter or export data. The exposed data includes names, dates of birth, demographic details, health metrics, and hospital admission information, but excludes Social Security numbers and financial data. There is no evidence that the data was accessed or misused, only that it may have been.