CVE-2026-124951

Not scored yetLast modified Nov 10, 2026

Description

Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.

Metrics

No CVSS score has been published yet.

Affected software

VendorProductVersions
MozillaFirefox—
MozillaThunderbird—

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1249528.8Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45.CVE-2026-1249597.1The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within theCVE-2026-124968.7Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS anCVE-2026-124977.5The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin before 4.16.18 CVE-2026-1249876.3A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. SCVE-2026-1249923.3A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the CVE-2026-1249935.3An incorrect authorization vulnerability in the Security Advisor in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-CVE-2026-1249946.3A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file eCVE-2026-12507.5The Court Reservation – Manage Your Court Bookings Online plugin for WordPress is vulnerable to generic SQL Injection via the ‘id’ parameterCVE-2026-125007.5The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WCVE-2026-125015.3The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's confiCVE-2026-125028.4Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD thro
CVE-2026-124951: Unscored | Vulnix