A resource consumption vulnerability exists in the a2aproject a2a-java component ChildQueue's queue.offer function up to version 1.2.0.Final. This flaw can be exploited remotely and leads to denial of service conditions by exhausting resources. Upgrading to version 1.3.0.Final resolves the issue.
KGS Software tia Viewer has a stored cross-site scripting (XSS) vulnerability in its annotation API. An authenticated attacker can inject malicious JavaScript into stickynote annotations, which executes when any user opens the affected document. This vulnerability can lead to session compromise. The issue is fixed in version 1.2.8.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a highly privileged local attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but affects integrity and availability.
PowerProtect Data Domain versions 7.7.1.0 through 8.7, including certain LTS2024, LTS2025, and LTS2026 releases, contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9, indicating medium severity.
A vulnerability in Octopus Server allows a user with permission to upload a malicious NuGet package to deploy a script step that executes outside of the intended parent directory. This could lead to unintended script execution paths. The issue affects unspecified versions of Octopus Server and has a medium severity rating with a CVSS score of 5.1.
CVE-2026-118026 is a vulnerability involving an invalid pointer in the JavaScript garbage collection (GC) component of Firefox. This security flaw was addressed and fixed in Firefox version 159. The vulnerability is classified with high impact according to the Mozilla advisory.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Relative Path Traversal vulnerability. This flaw could allow a high privileged attacker with remote access to tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7, and several LTS releases, contain a path traversal vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-31 and has a CVSS v3.1 score of 7.2, indicating high severity.
CVE-2026-118027 is a frame poisoning vulnerability in the Layout component of Firefox ESR. This security flaw was addressed and fixed in Firefox ESR version 115.44. The vulnerability is considered high impact by the vendor. No public exploit or active exploitation in the wild has been reported. Users of affected versions should upgrade to the fixed release to mitigate the risk.
A vulnerability in Netiket Information Technologies EdoWEB before version 780-g7 allows authorization bypass via a user-controlled key, enabling access to functionality not properly restricted by access control lists (ACLs). The flaw is identified as CWE-639 and has a CVSS 3.1 base score of 4.3, indicating medium severity. There is no public information about exploits in the wild or available patches.
CVE-2026-118019 is a high-impact vulnerability involving a race condition and use-after-free flaw in the DOM File component of Firefox. This issue was addressed and fixed in Firefox version 159. The vulnerability could potentially allow for memory corruption leading to security risks.
CVE-2026-118025 is a security vulnerability affecting the SVG component in Firefox. This issue was addressed and fixed in Firefox version 159. The vulnerability is part of a broader set of high-impact security fixes released in the same version. No specific exploitation details or CVSS score are provided.
CVE-2026-118024 is a use-after-free vulnerability in the Graphics: Text component of Firefox. This flaw was addressed and fixed in Firefox version 159. The vulnerability is considered high impact due to the potential risks associated with use-after-free bugs in browser components.
CVE-2026-118020 is a use-after-free vulnerability in the Layout component of Firefox. This security flaw was addressed and fixed in Firefox version 159. The vulnerability is classified with high impact severity by Mozilla. It is part of a broader set of memory safety issues resolved in the same Firefox release.
CVE-2026-118022 is a use-after-free vulnerability in the Disability Access APIs component of Firefox that allows sandbox escape. This security flaw was addressed and fixed in Firefox version 159. The vulnerability is considered high impact due to its potential to break out of the browser sandbox.
CVE-2026-118021 is a use-after-free vulnerability in the XPCOM component of Firefox that allows sandbox escape. This security flaw was addressed and fixed in Firefox version 159. The vulnerability is classified as high impact due to its potential to break sandbox protections.
CVE-2026-118023 is a use-after-free vulnerability in the Graphics: WebRender component of Firefox that allows sandbox escape. This vulnerability was fixed in Firefox version 159. The issue could enable an attacker to break out of the browser's sandbox environment, potentially leading to elevated privileges or code execution outside the intended security boundaries.
CVE-2026-118017 is a use-after-free vulnerability in the SVG component of Firefox. This security flaw was addressed and fixed in Firefox version 159. The vulnerability is classified with high impact by the vendor.
A use-after-free vulnerability exists in the JavaScript Engine's JIT component of Firefox. This vulnerability was addressed and fixed in Firefox version 159. The issue could lead to high impact security concerns if exploited.