Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 8.8 (HIGH)
Sandbox escape in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 10.0 (CRITICAL)
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Integer overflow in the JavaScript: Standard Library component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Sandbox escape in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 10.0 (CRITICAL)
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 10.0 (CRITICAL)
Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. CVSSv3.1 9.8 (CRITICAL)
Malicious scripts could cause desynchronization between the address bar and web content before a response is received in Firefox iOS, allowing attacker-controlled pages to be presented under spoofed domains. This vulnerability was fixed in Firefox for iOS 147.4. CVSSv3.1 9.8 (CRITICAL)
A vulnerability exists in REB500 for an authenticated user with Installer role to access and alter the contents of directories that the role is not authorized to do so. CVSSv3.1 8.1 (HIGH)
Bishop Fox disclosed an arbitrary command injection vulnerability in Samsung Tizen OS through version 9.0 affecting the Samsung Debug Bridge (SDB) service. The vulnerability allows OS-level code execution on Tizen-based smart TVs when developer mode is enabled and the attacker operates from the configured developer host IP. The flaw was demonstrated on multiple physical Samsung TV models (Tizen 5.5, 7.0, 8.0) and affects all versions supporting SDB.
Sliver v1.7.2 released with improvements to shell management (multi-shell support, backgrounding, listing, re-attachment), Windows PE metadata spoofing, macOS shellcode loader enhancements, and security fixes including RPC restriction for external builders and gzip size limits.
Sliver v1.7.3 released with a single bugfix reverting wasm-donut to v0.0.3 to resolve a regression in Windows shellcode generation. This is a maintenance release addressing a technical issue in the command-and-control framework.
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick’s path security policy is enforced on the raw filename string before the filesystem resolves it. As a result, a policy rule such as /etc/* can be bypassed by a path traversal. The OS resolves the traversal and opens the sensitive file, but the policy matcher only sees the unnormalized path and therefore allows the read. This enab CVSSv3.1 8.6 (HIGH)
ImageMagick is free and open-source software used for editing and manipulating digital images. `WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute the pixel buffer size. Prior to version 7.1.2-15, when image dimensions are large, the multiplication overflows 32-bit `int`, causing an undersized heap allocation followed by an out-of-bounds write. This can crash the process or potentially lead to an out of bounds heap write. Version 7.1.2-15 contains a patch. CVSSv3.1 8.2 (HIGH)
Sophos X-Ops' 2026 Active Adversary Report analyzes 661 incident response cases from Nov 2024–Oct 2025, revealing that identity-related attacks (compromised credentials, brute-force, phishing) now account for 67.32% of root causes—a multi-year dominance trend. Attackers are moving faster (3.4-hour median to AD compromise, 3-day dwell time) and increasingly exfiltrating data alongside ransomware; Impacket usage surged 83% YoY, while Cobalt Strike declined. Critical gaps persist: 59% of organizations lack MFA, firewall logging defaults are inadequate (7 days or less), and 13% run end-of-life Windows Server versions.
Elastic Security Labs introduces ES|QL COMPLETION, a new query language feature that embeds LLM reasoning directly into detection rules for alert triage. The technique correlates behavioral alerts by host or user, builds structured context, and uses LLM judgment to distinguish attack chains from benign activity (SCCM, Nessus, legitimate admin tools) without external orchestration. Two prebuilt rules are provided: LLM-Based Attack Chain Triage by Host and LLM-Based Compromised User Triage by User.
Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user. CVSSv3.1 8.1 (HIGH) · EPSS 14th percentile
Valkey is a distributed key-value database. Prior to versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12, a malicious user can use scripting commands to inject arbitrary information into the response stream for the given client, potentially corrupting or returning tampered data to other users on the same connection. The error handling code for lua scripts does not properly handle null characters. Versions 9.0.2, 8.1.6, 8.0.7, and 7.2.12 fix the issue. CVSSv3.1 8.5 (HIGH)