CVE-2026-117992

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

Information disclosure in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 159, Firefox ESR 115.44, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Oct 27, 2026
Last modified
Nov 5, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1179938.8Integer overflow in the Graphics: Text component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and ThundCVE-2026-1179948.8Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and ThunderCVE-2026-1179958.8Privilege escalation in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, ThundCVE-2026-1179968.1Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and CVE-2026-1179979.6Sandbox escape due to use-after-free in the Widget component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 15CVE-2026-1179988.8Mitigation bypass in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159,CVE-2026-1179998.8Race condition in the IPC component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, and Thunderbird 153.6.CVE-2026-11805.8A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private_key_jwt. The CVE-2026-118008.1A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid cCVE-2026-1180008.1Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, aCVE-2026-1180028.1Information disclosure due to race condition in the Networking component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, ThCVE-2026-1180038.1Information disclosure in the Networking: DNS component. This vulnerability was fixed in Firefox 159, Firefox ESR 153.6, Thunderbird 159, an
CVE-2026-117992: Medium severity, CVSS 6.5 | Vulnix