CVE-2026-102816

Unauthenticated Wireless Regulatory Region Configuration in TP-Link RE305

An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on the same local network may modify the wireless regulatory region and force the device to reapply its wireless configuration.  Successful exploitation may cause wireless connection interruptions, unavailable channels, client disconnections, or wireless service instability, and may cause the device to apply parameters intended for a different regulatory region.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Re305

CVE-2026-102800

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0

Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article helpful” voting widget posts a client-supplied ip field to its AJAX handlers (getDeny, getConfirm, getDenyReason in mod_djhelpful_articles/helper.php), reachable without authentication through com_ajax. The value was stored exactly as submitted instead of being taken from the connection by the server. It was then printed without output escaping in the administrator backend’s “Helpful articles” overview (views/items/tmpl/default.php). $db->quote() was applied on insert, which protects the SQL statement but does nothing for HTML output. There was no CSRF token, no rate limit, and the vote de-duplication keyed on the same attacker-controlled field.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-102638

Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the library is imported, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Autodesk

Products

Fusion

CVE-2026-102637

Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Autodesk

Products

Fusion

CVE-2026-102636

Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Autodesk

Products

Fusion

CVE-2024-0193

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Codeready Linux Builder Codeready Linux Builder For Eus and 24 more

CVE-2026-117879

Incorrect boundary conditions in the Layout: Tables component

Incorrect boundary conditions in the Layout: Tables component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117910

Invalid pointer in the JavaScript Engine component

Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2026-117912

Same-origin policy bypass in the CSS Parsing and Computation component

Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-117923

Use-after-free in the Audio/Video component

Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2026-118178

RSS feed could redirect its subscription to a local file or network share

A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Thunderbird

CVE-2024-4027

Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an OutOfMemoryError when the client sends a request with large parameter names. This issue can be exploited by an unauthorized user to cause a remote denial-of-service (DoS) attack.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Camel K Jboss Bpms Jboss Data Grid and 6 more

CVE-2024-31083

Xorg-x11-server: use-after-free in procrenderaddglyphs

A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.

CVSS 3.1 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2024-31082

Xorg-x11-server: heap buffer overread/data leakage in procappledricreatepixmap

A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2024-31081

Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice

A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2024-31080

Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents

A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2024-3183

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal key directly. For user principals, this key is a hash of a public per-principal randomly-generated salt and the user’s password. If a principal is compromised it means the attacker would be able to retrieve tickets encrypted to any principal, all of them being encrypted by their own key directly. By taking these tickets and salts offline, the attacker could run brute force attacks to find character strings able to decrypt tickets when combined to a principal salt (i.e. find the principal’s password).

CVSS 3.1 · 8.1 High EPSS 2.1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Aus Enterprise Linux Eus and 6 more

CVE-2024-3094

Xz: malicious code in distributed source

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

CVSS 3.1 · 10 Critical EPSS 90.9% KEV · Not listed

Vendors

Redhat Tukaani

Products

Enterprise Linux Jboss Enterprise Application Platform Rhel Els and 1 more

CVE-2024-3049

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Clusterlabs Redhat

Products

Booth Enterprise Linux Enterprise Linux Eus and 10 more

CVE-2024-3019

Pcp: exposure of the redis server backend allows remote command execution via pmproxy

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more