98723 matches found
GHSA-6HQ5-7373-42RG PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...
PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
Summary The domain whitelist introduced in PhpSpreadsheet 5.4.0 for the WEBSERVICE formula function can be bypassed via HTTP redirect. The whitelist validates only the initial URL's hostname, but filegetcontents follows 302/301 redirects by default without re-validating the redirect target agains...
sops v3.13.3
SOPS: Secrets OPerationS SOPS is an editor of encrypted files that supports YAML, JSON, ENV, INI and BINARY formats and encrypts with AWS KMS, GCP KMS, Azure Key Vault, HuaweiCloud KMS, age, and PGP. demo .. image:: https://i.imgur.com/X0TM5NI.gif .. image::...
Mozilla Firefox ESR buffer overflow vulnerability (CNVD-2026-31197)
Mozilla Firefox ESR is an extended support version of Firefox a web browser open-sourced by the Mozilla Foundation. Mozilla Firefox ESR has a buffer overflow vulnerability. This vulnerability stems from a memory security flaw; attackers can exploit this vulnerability to cause memory corruption,...
Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2026-204-01)
The version of mozilla-thunderbird installed on the remote host is prior to 140.13.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2026-204-01 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...
Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...
GHSA-8HG6-C449-896M Dompdf: Uncontrolled resource consumption based on declared BMP dimensions
Summary dompdf accepts a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is accepted and later drives imagecreatetruecolor$width,...
stackrox v4.11.2-rc.1
Table of Contents StackRox Kubernetes Security Platform Table of Contents Community Deploying StackRox Quick Installation using Helm Manual Installation using Helm Installation using the Operator Installation via Scripts Kubernetes Distributions EKS, AKS, GKE OpenShift Docker Desktop, Colima, or...
[SECURITY] [DLA 4695-1] firefox-esr security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4695-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort July 22, 2026 https://wiki.debian.org/LTS -...
[SECURITY] [DSA 6394-1] firefox-esr security update
------------------------------------------------------------------------- Debian Security Advisory DSA-6394-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 22, 2026 https://www.debian.org/security/faq -...
CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding
The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...
CVE-2026-14899 Off-by-one out of bounds read in MIME header parser for forwarding
The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...
CVE-2026-14899
The code to parse MIME headers for display when forwarding a message if the setting to view all headers was enabled had an off-by-one error, allowing a single byte to be read from the memory after the buffer for the headers, and potentially crashing Thunderbird. This vulnerability was fixed in...
RLSA-2026:42062 Important: webkit2gtk3 security update
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...
webkit2gtk3 security update
An update is available for webkit2gtk3. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list WebKitGTK is the port of the portable web rendering engine WebKit to the...
CVE-2026-57963
A flaw was found in Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker who can send HTML chat messages via Matrix or XMPP can inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI...
CVE-2026-16397
creationtimestamp| type| source ---|---|--- 2026-07-22 04:47:27+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722...
CVE-2026-16396
creationtimestamp| type| source ---|---|--- 2026-07-22 04:47:25+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 19:28:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrb2lrqdq52k...
CVE-2026-16393
creationtimestamp| type| source ---|---|--- 2026-07-22 04:47:18+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 18:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mraxvvpvmq2e...