CVE-2026-2784

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published: Feb 24, 2026
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-278404.3ZITADEL is an open source identity management platform. Starting in version 2.31.0 and prior to versions 3.4.7 and 4.11.0, opaque OIDC acces CVE-2026-278418.1A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Req CVE-2026-278429.3Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device CVE-2026-278439.1A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without su CVE-2026-278442.7Uncaught Exception (CWE-248) in the Controller 6000 and Controller 7000 diagnostic web interface allows an authenticated and authorized oper CVE-2026-278466.2Due to missing authentication, a user with physical access to the device can misuse the mesh functionality for adding a new mesh device to t CVE-2026-278479.8Due to improper neutralization of special elements, SQL statements can be injected via the handshake of a TLS-SRP connection. This can be us CVE-2026-278489.8Due to missing neutralization of special elements, OS commands can be injected via the handshake of a TLS-SRP connection, which are ultimate CVE-2026-278499.8Due to missing neutralization of special elements, OS commands can be injected via the update functionality of a TLS-SRP connection, which i CVE-2026-27859.8Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thu CVE-2026-278507.5Due to an improperly configured firewall rule, the router will accept any connection on the WAN port with the source port 5222, exposing all CVE-2026-278519.1When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabli