CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.11)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Podatność CVE-2026-6769 dotyczy eskalacji uprawnień w komponencie Debugger. Została naprawiona w wersjach Firefox 150, Firefox ESR 140.10, Thunderbird 150 oraz Thunderbird 140.10.
Podatność umożliwia eskalację uprawnień w komponencie sieciowym. Została naprawiona w wersjach Firefox 150, Firefox ESR 140.10, Thunderbird 150 oraz Thunderbird 140.10.
Podatność typu use-after-free w komponencie Widget: Cocoa. Została naprawiona w wersjach Firefox 150, Firefox ESR 140.10, Thunderbird 150 oraz Thunderbird 140.10.
Podatność typu use-after-free w komponencie JavaScript: WebAssembly. Została naprawiona w wersjach Firefox 150 i Thunderbird 150.
Podatność w Firefox dla Androida umożliwia obejście środków zaradczych. Została naprawiona w wersji Firefox 150.
A use-after-free vulnerability was found in the JavaScript Engine component of Firefox and Thunderbird. It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Incorrect boundary conditions were found in the WebRTC component of Firefox and Thunderbird, potentially leading to unexpected behavior. The vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A vulnerability in the WebRTC component of Firefox and Thunderbird is caused by incorrect boundary conditions. The flaw was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
An uninitialized memory vulnerability was found in the Audio/Video: Web Codecs component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A privilege escalation vulnerability exists in the Graphics: WebRender component of Firefox and Thunderbird. It is fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Information disclosure vulnerability in the Graphics: Canvas2D component due to uninitialized memory. Fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
A use-after-free vulnerability was found in the WebRTC component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
Use-after-free vulnerability in the DOM: Core & HTML component of Firefox and Thunderbird. The flaw was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
FreePBX API module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization. An authenticated user with a valid bearer token can execute arbitrary commands on the host as the web server user.
The vulnerability in Quantum Networks router is due to improper access control and insecure default configuration in the web-based management interface. An unauthenticated attacker could exploit this vulnerability by accessing exposed API endpoints on the targeted device.
The vulnerability in Quantum Networks router is due to the lack of enforcement of strong password policies in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing password guessing or brute-force attacks against user accounts, leading to unauthorized access to the targeted device.
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
The vulnerability in Quantum Networks router is due to missing rate limiting and CAPTCHA protection for failed login attempts in the web-based management interface. An attacker on the same network could exploit this vulnerability by performing brute force attacks against administrative credentials, leading to unauthorized access with root privileges on the targeted device.
The vulnerability in Quantum Networks router arises from inadequate sanitization of user-supplied input in the management CLI interface. An authenticated remote attacker could exploit this vulnerability to inject arbitrary OS commands on the targeted device.
Podatność CVE-2026-39467 dotyczy deserializacji niezaufanych danych w wtyczce MetaSlider Responsive Slider, co umożliwia wstrzyknięcie obiektów. Problem ten dotyczy wersji wtyczki od n/a do 3.106.0.