CVE-2026-118008

Publié : 27 octobre 2026

Modifié : 27 octobre 2026

Lien officiel NVD

Score CVSS

8.8

HIGH

Description détaillée

Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Références et Patchs

https://bugzilla.mozilla.org/show_bug.cgi?id=2075440 https://www.mozilla.org/security/advisories/mfsa2026-118/

Dernières Vulnérabilités

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution (RCE) via UPnP root description parsing.

VOIR DÉTAILS

CVE-2026-117604

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.

VOIR DÉTAILS

CVE-2026-117507

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.

VOIR DÉTAILS