CVE-2026-124903

Sandbox escape vulnerability due to use-after-free in the Widget: Gtk component of Firefox. It may allow bypassing process isolation. The vulnerability was fixed in Firefox 160 and Firefox ESR 153.7.

A use-after-free in the DOM: Service Workers component of Firefox allows a sandbox escape. The vulnerability was fixed in Firefox 160.

Use-after-free vulnerability in the DOM: Service Workers component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Use-after-free vulnerability in the Audio/Video: cubeb component of Firefox enabling a sandbox escape. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

Sandbox escape in the Storage: Cache API component of Firefox caused by incorrect boundary conditions. It may allow bypassing browser isolation mechanisms. Fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

A sandbox escape vulnerability due to incorrect boundary conditions exists in the Graphics: Text component of Firefox. This vulnerability was fixed in Firefox 160, Firefox ESR 115.45, and Firefox ESR 153.7.

A Session Fixation vulnerability in the CLI login flow in nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. The confirmation code is only displayed and never compared, so it cannot prove that the confirming person is the one who started the login.

An unauthenticated remote attacker can perform an XSS attack on a logged-in backend user, allowing execution of multiple critical system actions such as shutting down the server or restoring an uploaded backup.

The described vulnerability could allow an attacker to compromise a system. Technical details are not provided in the description.

A partial string comparison vulnerability in HiRDB. The issue affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and Version 9 (from 09-50-06 through 09-66-22), including versions with additional functions.