CVE-2026-121583

Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization

A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the argument userId leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The web trade payment controller was removed starting with the 202608 series (commit 7329437).

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Publiccms Sanluan

Products

Publiccms Publiccms

CVE-2026-121542

Bake filesystem path entitlements approval can be skipped for path using basename prefix

In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the expected fs.read approval. Under certain conditions, paths under the same parent directory as the current working directory whose names use the working directory's basename as a prefix can skip the filesystem entitlement check. Exploitation requires specific matching filenames next to the current project directory. Users who run untrusted Bake definitions may be affected. The issue is fixed in v0.38.1.

CVSS 4.0 · 1.8 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-121535

miroslavpejic85 MiroTalk P2P Room Action server.js checkPassword excessive authentication

A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file app/src/server.js of the component Room Action Handler. The manipulation results in improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The exploit has been made public and could be used. Upgrading to version 2.1.38 is able to resolve this issue. The patch is identified as 55bec1d05f931d2e43633d6d0b7274f79ec719dd. Upgrading the affected component is advised.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Miroslavpejic85

Products

Mirotalk P2p

CVE-2026-121373

Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)

The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content attributes of meta tags using a regular expression that is too narrow, allowing sanitization to be bypassed, and resulting in potential URL redirection to untrusted sites in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11. The shared declarative refresh steps in the WHATWG HTML Standard require a broader approach: the separator after the time may be ASCII whitespace alone, with no ; or ,, and the url= keyword is optional. Directives the browser honours, but the regular expression misses are returned unchanged, so the attacker URL skips UrlSanitizer entirely and both allowLinkSchemes and allowLinkHosts are defeated for the refresh navigation. This is reachable under any configuration that allows meta with http-equiv and content, including the documented allowStaticElements() preset.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sensiolabs

Products

Symfony

CVE-2026-119746

ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-118865

Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component

An authenticated OS command injection vulnerability exists in the Offline Download component (USB storage allocation) of Archer AX3000 v2. When a USB storage device is attached, an authenticated administrator can submit a crafted path value containing shell metacharacters that is not properly neutralized before being passed to a system command.  Successful exploitation may allow arbitrary command execution on the affected device.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-117927

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117922

Use-after-free in the Networking: WebSockets component

Use-after-free in the Networking: WebSockets component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117915

Incorrect boundary conditions in the Layout: Block and Inline component

Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117914

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117913

Use-after-free in the SVG component

Use-after-free in the SVG component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117911

Use-after-free in the Audio/Video: Playback component

Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117909

Use-after-free in the JavaScript: GC component

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117907

Use-after-free in the Networking component

Use-after-free in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117906

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117897

Incorrect boundary conditions in the Layout: Tables component

Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117896

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117895

Use-after-free in the DOM: Core & HTML component

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117892

Privilege escalation due to use-after-free in the WebRTC: Networking component

Privilege escalation due to use-after-free in the WebRTC: Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117891

Use-after-free in the JavaScript Engine: JIT component

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox