Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119776 | not reported | — | No | In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local sourc... | 2026-11-04 |
| CVE-2026-120567 | medium | 5.4 | No | The MongoDB Entity Framework Core provider does not neutralize special elements in values passed to SetProperty when an ExecuteUpdate call a... | 2026-11-04 |
| CVE-2026-13162 | not reported | — | No | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system command... | 2026-11-04 |
| CVE-2026-118180 | high | 7.5 | No | When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it.... | 2026-11-04 |
| CVE-2026-118179 | high | 8.8 | No | Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the lin... | 2026-11-04 |
| CVE-2026-118178 | medium | 5.7 | No | A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.... | 2026-11-04 |
| CVE-2026-118177 | critical | 9.1 | No | When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted cale... | 2026-11-04 |
| CVE-2026-118176 | high | 8.1 | No | Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengt... | 2026-11-04 |
| CVE-2026-118175 | high | 7.5 | No | When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the... | 2026-11-04 |
| CVE-2026-118174 | medium | 6.5 | No | When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer import... | 2026-11-04 |
| CVE-2026-118173 | not reported | — | No | MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags.... | 2026-11-04 |
| CVE-2026-118172 | medium | 6.1 | No | The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispat... | 2026-11-04 |
| CVE-2026-91390 | medium | 5.4 | No | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26... | 2026-11-04 |
| CVE-2026-118171 | medium | 6.5 | No | The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privi... | 2026-11-04 |
| CVE-2026-118170 | critical | 9.1 | No | The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe... | 2026-11-04 |
| CVE-2026-118132 | medium | 6.1 | No | NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of exte... | 2026-11-04 |
| CVE-2026-117870 | high | 7.3 | No | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thund... | 2026-11-04 |
| CVE-2026-117869 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117868 | critical | 9.6 | No | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunder... | 2026-11-04 |
| CVE-2026-117867 | high | 7.3 | No | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,... | 2026-11-04 |