CVE-2026-2796

CriticalCVSS 9.8/10Last modified Jul 15, 2026

Description

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

No affected versions have been published.

Timeline

Published
Feb 24, 2026
Last modified
Jul 15, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-279609.8OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, thereCVE-2026-279618.8Agenta is an open-source LLMOps platform. A Server-Side Template Injection (SSTI) vulnerability exists in versions prior to 0.86.8 in AgentaCVE-2026-279629.1Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in aCVE-2026-279634.8Audiobookshelf is a self-hosted audiobook and podcast server. A stored cross-site scripting (XSS) vulnerability exists in versions prior to CVE-2026-279643.9FacturaScripts is an open source accounting and invoicing software. Versions 2025.7 and prior contain a Reflected Cross-Site Scripting (XSS)CVE-2026-279659.9Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access tCVE-2026-279669.8Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.8.0, the CSV Agent node in Langflow hardcoCVE-2026-279677.1Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `edit_file`). It allowCVE-2026-279684.3Packistry is a self-hosted Composer repository designed to handle PHP package distribution. Prior to version 0.13.0, RepositoryAwareControllCVE-2026-279698.8Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access tCVE-2026-27979.8Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.CVE-2026-279706.1Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions
CVE-2026-2796: Critical severity, CVSS 9.8 | Vulnix