CVE-2026-8961
Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunder
CVSS
6.5
Medium
EPSS
0.3%
p25
KEV
—
Exploit Today
8
0-100
Published: May 19, 2026 · Last modified: Jul 23, 2026 · CWE-290
0.3%EPSS · 30 days0.3%
2026-08-172026-09-13
Spoofing issue in the Form Autofill component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
- bugzilla.mozilla.orghttps://bugzilla.mozilla.org/show_bug.cgi?id=1962625
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-46/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-48/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-50/
- www.mozilla.orghttps://www.mozilla.org/security/advisories/mfsa2026-51/
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-734495.9 MED—
———On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions.
This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network.
Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.14hCVE-2026-180655.3 MED—
———IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.16hCVE-2026-88819——
———In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.16hCVE-2026-21391——
——0An improper validation vulnerability exists within PingAM where a well-crafted request allows arbitrary or protected ID Token claims to be set or overridden. In certain configurations this could allow an attacker to bypass authentication controls via spoofing leading to privilege escalation or impersonation.21hCVE-2026-877859.1 CRI—
——0Authentication bypass by spoofing vulnerability in Apache Syncope.
When the configured JWKS settings for internal JWT authentication are disclosed (at least protocol and key), an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT.
This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.7, from 4.1.0-M0 through 4.1.2.
Users are recommended to upgrade to version 4.0.8 / 4.1.3, which fix this issue.15hCVE-2025-686244.3 MED—
——0N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding.17h