CVE-2026-100775 high firefox: thunderbird: Sandbox escape in the Graphics component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100774 high firefox: Use-after-free in the DOM: Core & HTML component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100773 high firefox: thunderbird: Use-after-free in the Storage: IndexedDB component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100772 high firefox: thunderbird: Use-after-free in the DOM: Core & HTML component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100771 high firefox: thunderbird: Undefined behavior in the DOM: Streams component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100770 high firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100769 high firefox: thunderbird: Use-after-free in the JavaScript: WebAssembly component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100768 high firefox: Use-after-free in the Graphics: WebGPU component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100767 high firefox: thunderbird: Use-after-free in the Networking: Cache component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100766 high firefox: thunderbird: Information disclosure in the Networking: JAR component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100762 high firefox: Sandbox escape due to use-after-free in the DOM: Content Processes component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100761 high firefox: Privilege escalation due to use-after-free in the Graphics: WebGPU component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100760 high firefox: Sandbox escape in the Security: Process Sandboxing component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100759 high firefox: thunderbird: Uninitialized memory in the Storage: Quota Manager component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100758 high firefox: thunderbird: Sandbox escape in the DOM: Navigation component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100757 high firefox: thunderbird: Use-after-free in the Widget component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100756 high firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102496 high org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service (DoS) via deeply nested schema structures since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102495 high org.apache.ws.xmlschema/xmlschema-core: Apache XMLSchema: Denial of Service via unbounded recursion during schema parsing since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95509 high qt: Qt for MCUs: Denial of service via out-of-bounds read in string formatting since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-96423 high wireshark: Heap-based Buffer Overflow in Wireshark since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-96419 high wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95389 high wireshark: Heap-based Buffer Overflow in Wireshark since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-95387 high wireshark: wireshark: Denial of Service via heap-based buffer overflow in SPDY dissector since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-84739 high Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-19547 high ghostscript: ghostscript: Local privilege escalation via predictable resource search path since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-91012 high org.apache.karaf.config/org.apache.karaf.config.core: Apache Karaf: Privilege escalation via path traversal in configuration service since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-97024 high flatpak: flatpak: Arbitrary write in root context via path traversal in deploy directory files/etc since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102422 high shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102281 high Nest: Remote process termination via a deeply nested microservice message pattern since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102278 high brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102276 high brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102275 high pyjwt: PyJWT: Token verification bypass via mismatched OKP key components since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102274 high pyjwt: pyjwt: Denial of Service via malformed RSA key in JWK set since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102273 high pyjwt: pyjwt: Token forgery via acceptance of public JWK containers as HMAC secrets since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102272 high pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-102271 high pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101918 high pyjwt: PyJWT: Denial of Service via deeply nested JSON token payload since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101917 high pyjwt: PyJWT: Denial of Service via outbound request amplification on unknown key identifiers since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101916 high grpc-js: grpc-js: Authentication bypass via improper peer certificate validation since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-96760 high authlib: authlib: Signature verification bypass via deserialize_json since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-93355 high litellm: LiteLLM: Privilege escalation via unverified email lookup in JWT authentication since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-97023 high flatpak: flatpak: Arbitrary file deletion in root context via path traversal in deploy directory export/bin since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-96740 high streamshub/console: console-operator: Streams for Apache Kafka Console: Unfiltered Kafka client properties → SA-token exfiltration via config.providers since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-55157 high Token Optimizer MCP: OS command injection in smart_user via username in get-user-info since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101909 high axios: axios: Denial of Service via prototype pollution gadget in form serialization since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101906 high axios: axios: Denial of Service via crafted redirect hostname since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101905 high axios: axios: Request socket hijacking via inherited createConnection property since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101903 high axios: Axios: Denial of Service via malformed data URLs since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 CVE-2026-101901 high axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization since at least 24 Oct 2026 07:11 UTC build 28 Sep 2026 