CVE-2026-8091
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox
CVSS
9.8
Critical
EPSS
0.4%
p36
KEV
—
Exploit Today
11
0-100
Published: May 7, 2026 · Last modified: Jul 15, 2026 · CWE-754 · CWE-805
0.4%EPSS · 30 days0.4%
2026-06-302026-07-16
Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=2029301
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-30/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-33/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-36/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-39/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-42/
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-8091
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2467699
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8091.json
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-256397.5 HIG82.9%
——25Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can trigger this by providing a malicious configuration object created via JSON.parse(), causing complete denial of service. This vulnerability is fixed in versions 0.30.3 and 1.13.5.22hCVE-2026-59467.5 HIG76.2%
——23Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section. Specially crafted requests reaching the affected code paths — recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or processing of `IN`-specific record types in non-`IN` data — can cause assertion failures in `named`.
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.48, 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.48-S1, and 9.20.9-S1 through 9.20.22-S1.2dCVE-2026-46947.5 HIG51.6%
——15Incorrect boundary conditions, integer overflow in the Graphics component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.2dCVE-2026-46908.6 HIG51.6%
——15Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.2dCVE-2026-46867.5 HIG49.1%
——15Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.2dCVE-2026-46997.5 HIG48.6%
——15Incorrect boundary conditions in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9.2d