CVE Watch15 jul 2026

CVE-2026-0878

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Fir

CVSS

8.0

Alto

EPSS

0.4%

p34

KEV

—

Exploit Today

0-100

Publicado: 13 ene 2026 · Última mod.: 15 jul 2026 · CWE-20 · CWE-119

EPSS · 30d

0.4%EPSS · 30 días0.4%

2026-06-302026-07-19

Descripción técnica

Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability5d CVE-2025-312778.8 ALT

71.0%

KEV—71Apple Multiple Products Buffer Overflow Vulnerability5d CVE-2026-125699.8 CRÍ

66.0%

KEV—70PTC Windchill and FlexPLM Improper Input Validation Vulnerability20d CVE-2025-607877.2 ALT

97.0%

——29MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.15d CVE-2005-445910.0 SIN

96.2%

——29Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted (1) EPRT and (2) PORT FTP commands.12d CVE-2017-149197.5 ALT

94.3%

——28Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.6d