Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118178 | medium | 5.7 | No | A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.... | 2026-11-04 |
| CVE-2026-118177 | critical | 9.1 | No | When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted cale... | 2026-11-04 |
| CVE-2026-118176 | high | 8.1 | No | Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-lengt... | 2026-11-04 |
| CVE-2026-118175 | high | 7.5 | No | When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the... | 2026-11-04 |
| CVE-2026-118174 | medium | 6.5 | No | When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer import... | 2026-11-04 |
| CVE-2026-118173 | not reported | — | No | MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for required taxonomy tags.... | 2026-11-04 |
| CVE-2026-118172 | medium | 6.1 | No | The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispat... | 2026-11-04 |
| CVE-2026-91390 | medium | 5.4 | No | Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26... | 2026-11-04 |
| CVE-2026-118171 | medium | 6.5 | No | The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpoint. This allows low-privi... | 2026-11-04 |
| CVE-2026-118170 | critical | 9.1 | No | The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe... | 2026-11-04 |
| CVE-2026-118132 | medium | 6.1 | No | NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to unsafe rendering of exte... | 2026-11-04 |
| CVE-2026-117870 | high | 7.3 | No | Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thund... | 2026-11-04 |
| CVE-2026-117869 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunde... | 2026-11-04 |
| CVE-2026-117868 | critical | 9.6 | No | Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunder... | 2026-11-04 |
| CVE-2026-117867 | high | 7.3 | No | Use-after-free in the Layout component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159,... | 2026-11-04 |
| CVE-2026-117866 | high | 7.3 | No | Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115... | 2026-11-04 |
| CVE-2026-117557 | medium | 6.1 | No | SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips... | 2026-11-04 |
| CVE-2026-117538 | medium | 4.1 | No | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is co... | 2026-11-04 |
| CVE-2026-117534 | medium | 5.4 | No | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete his... | 2026-11-04 |
| CVE-2026-117530 | medium | 6.7 | No | In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands | 2026-11-04 |