CVE-2026-117921

Use-after-free in the CSS Parsing and Computation component

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117920

Use-after-free in the DOM: HTML Parser component

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117918

Use-after-free in the Graphics: Canvas2D component

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117466

Privilege Escalation in Octopus Server via System Manager role

In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full system Administrator.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Octopus

Products

Octopus Server

CVE-2026-117341

Privilege Escalation through Exposure of Invitation Code in Octopus Server Audit Log

In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event log. When the invitation is linked to a space, a user in that space with appropriate permissions could read the code from the audit event. Successfully exploiting this by redeeming the unclaimed invitation could allow the user to escalate privileges however this is dependant on the permissions assigned for the invited user.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Octopus

Products

Octopus Server

CVE-2026-116662

Tanium addressed a compression bomb vulnerability in Enforce.

Tanium addressed a compression bomb vulnerability in Enforce.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116659

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116657

Tanium addressed a denial of service vulnerability in Enforce.

Tanium addressed a denial of service vulnerability in Enforce.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116656

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Enforce

CVE-2026-116214

MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Maccms Magicblack

Products

Maccms Maccms10

CVE-2026-115750

mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Frontmcp

Products

Mcp-from-openapi

CVE-2026-115495

Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user’s VPN username and password.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Mobile Vpn With Ssl Client

CVE-2026-115413

AWS API MCP Server OAuth Token Audience Validation Bypass

Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might allow local users to run AWS operations with the server's configured AWS credentials via an access token issued to another application by the same identity provider. To remediate this issue, users should upgrade to version 1.6.0 and configure the expected token audience or client ID for the server.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Aws-api-mcp-server

CVE-2026-115353

Mistune before 3.3.0 Path Traversal via include Directive

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Lepture Mistune Project

Products

Mistune Mistune

CVE-2026-115334

Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint

Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Uselotus

Products

Lotus

CVE-2026-115330

Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metric queries. Attackers can submit semicolon-separated SQL through POST /app/metrics/, bypassing first-statement-only validation, to read or modify data across all tenants.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Uselotus

Products

Lotus

CVE-2026-114598

Access of resource using incompatible type ('type confusion') in EPICS Base

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114597

Improper handling of length parameter inconsistency in EPICS Base

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114596

Integer overflow or wraparound in EPICS Base

In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base

CVE-2026-114595

Integer overflow or wraparound in EPICS Base

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

The Epics Community

Products

Epics Base