CVE-2026-4701

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4698

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4711

Use-after-free in the Widget: Cocoa component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

CVE-2026-4724

Undefined behavior in the Audio/Video component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

ROS-20260324-73-0016

Vulnerability in kernel-lt related to insufficient control of the resource during its existence. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

ROS-20260324-73-0024

Vulnerability in kernel-lt related to insufficient control of the resource during its existence. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

CVE-2026-4645

Removed by vendor...

GHSA-RJCW-VG7J-M9RC vulnerabilities

Vulnerabilities for packages: kubescape, kubescape-operator-fips, kubescape-server-fips, syft-fips, xeol, xeol-fips, kubescape-server, zarf, chainctl, zarf-fips, kubescape-operator, cg, k9s-fips, wolfictl, guac, chainctl-fips, k9s, grype-db...

cpython: IMAP command injection in user-controlled commands

A flaw was found in the imaplib module in the Python standard library. The imaplib module does not reject control characters, such as newlines, in user-controlled input passed to IMAP commands. This issue allows an attacker to inject additional commands to be executed in the IMAP server...

CVE-2026-4541

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/cryptosigned25519tinyssh.c of the component Ed25519 Signature Handler. This manipulation causes improper verification of cryptographic signature. The attack is restricted to local...

GHSA-RF6F-7FWH-WJGH vulnerabilities

Vulnerabilities for packages: prism, sqlpad, renovate, eslint, langfuse, kubeflow-katib, vitess...

GHSA-RF6F-7FWH-WJGH vulnerabilities

Vulnerabilities for packages: semaphore, wazuh-dashboard-fips, kubeflow-katib, sqlpad, wazuh-dashboard, authentik, langfuse, langfuse-fips, drupal, librechat, vitess, gitlab-rails-ce-fips, renovate, arangodb, gitlab-rails-ce, authentik-fips, prism, eslint...

CVE-2026-32829 vulnerabilities

Vulnerabilities for packages: vector, qdrant, py3-xet-core, parseable...

CVE-2026-23275

In the Linux kernel, the following vulnerability has been resolved: iouring: ensure ctx-rings is stable for task work flags manipulation If DEFERTASKRUN | SETUPTASKRUN is used and task work is added while the ring is being resized, it's possible for the OR'ing of IORINGSQTASKRUN to happen in the...

GHSA-4FCP-JXH7-23X8 vulnerabilities

Vulnerabilities for packages: vale...

GHSA-PCGW-QCV5-H8CH vulnerabilities

Vulnerabilities for packages: teleport...

CVE-2026-32942

PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below contain a heap use-after-free vulnerability in the ICE session that occurs when there are race conditions between session destruction and the callbacks. This issue has been fixed in version 2.17...

CVE-2026-1525 vulnerabilities

Vulnerabilities for packages: code-server, langfuse, jitsucom-jitsu, renovate...

CVE-2026-4460

Out of bounds read in Skia in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: High...

CVE-2026-4449

Use after free in Blink in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...