CVE-2026-117962

Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component

Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-112443

Improved Memory Handling Fix to Prevent Unexpected System Termination and Process Corruption

The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or corrupt process memory.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-121234

chromium-browser: Privilege elevation in Contacts

Privilege elevation in Contacts in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Android Chrome

CVE-2026-22058

CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID (formerly StorageGRID Webscale) versions 11.3 and higher allow an attacker with product-specific knowledge and the ability to communicate with the Grid Network on certain ports to make unauthorized requests.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Netapp

Products

Storagegrid

CVE-2026-115829

Secret Server Authentication Bypass via Unauthenticated Pin Code Reset and Brute Force

In Secret Server on-prem versions earlier than 12.3.1, a user could cause a two-factor pin code to be generated for any account without prior authentication, then bypass the initial login step and authenticate using the second factor alone.

CVSS 4.0 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Delinea

Products

Secret Server

CVE-2026-112497

Sandbox Escape via Improper Permissions Checking

This issue was addressed with improved permissions checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to break out of its sandbox.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2026-14571

SQL injection (SQLi) in the user authentication module of Futurum Software

A Blind SQL Injection vulnerability in Futurum Software’s management software, caused by a lack of adequate validation and sanitisation of user-provided inputs in queries to the private area’s database, as well as by an incorrect WAF configuration. This weakness allows the protection mechanisms to be bypassed solely by sending manipulated HTTP requests. Successful exploitation of the vulnerability could allow an unauthenticated attacker to execute arbitrary queries against the database, extract its complete structure and gain access to sensitive customer information, including personally identifiable information (PII).

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Futurum Software

Products

Futurum Software User Authentication Module

CVE-2026-118633

Path‑Traversal Remote Code Execution Risk in Sophos SG UTM Email Proxy

A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Sophos

Products

Sg Utm

CVE-2026-117988

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117985

Sandbox escape due to use-after-free in the Graphics component

Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-104383

Code injection in EagleCloud Aquila on-premises version

Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Eaglecloud

Products

Aquila

CVE-2026-117946

Incorrect boundary conditions in the JavaScript Engine component

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-121250

chromium-browser: Use after free in Extensions

Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-121073

chromium-browser: Use after free in Network

Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Low)

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Google

Products

Chrome

CVE-2026-11861

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Freeipa Redhat

Products

Freeipa Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2026-50628

Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control

A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Cxf Build Of Apache Camel Fuse and 1 more

CVE-2026-120280

WAVLINK WN536AX6-A WireGuard protocol.csp wireguard_cli_group handler os command injection

A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a

CVE-2026-120276

WAVLINK WN536AX6-A Web Management ioos sub_416760 os command injection

A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.

CVSS 4.0 · 10 Critical EPSS 3.2% KEV · Not listed

Vendors

Wavlink

Products

Wn536ax6-a

CVE-2026-120229

WAVLINK WN553X1-B ioos sub_416B50 os command injection

A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This issue affects the function sub_416B50 of the file /bin/ioos. The manipulation of the argument file_id leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.

CVSS 4.0 · 9.4 Critical EPSS 2.8% KEV · Not listed

Vendors

Wavlink

Products

Wn553x1-b

CVE-2026-120225

Oray Pugongying X5 Pro openwrt_release config_restore_ex path traversal

A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1. Affected by this vulnerability is the function config_restore_ex of the file /etc/openwrt_release. This manipulation of the argument filename causes relative path traversal. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Oray

Products

Pugongying X5 Pro