PT-2026-102543

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102546

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 140.17 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the DOM: Core & HTML component. A use-after-free occurs...

PT-2026-102554

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 115.42 Firefox ESR versions prior to 140.17 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the DOM: Core & HTML...

PT-2026-102604

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists in the DOM: UI Events & Focus Handling component. A use-after-free is a memory corruption flaw that...

Ubuntu 24.04 LTS / 26.04 LTS : FreeRDP vulnerabilities (USN-8836-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8836-1 advisory. It was discovered that FreeRDP contained multiple security issues. An attacker could possibly use these issues to obtain sensitive information, cause...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Erlang vulnerabilities (USN-8827-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8827-1 advisory. It was discovered that the Erlang Port Mapper Daemon did not properly handle slow...

Debian dsa-6529 : libwebsockets-dev - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6529 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6529-1 [email protected] https://www.debian.org/security/ Moritz...

Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

Ubuntu 24.04 LTS : libvirt vulnerabilities (USN-8831-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8831-1 advisory. It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler. A local attacker could possibly use this issue ...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-3125)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3125 advisory. A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

KLA91308 Multiple vulnerabilities in TeamViewer

Multiple vulnerabilities were found in TeamViewer. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, bypass security restrictions, cause denial of service. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability can be...

SUSE CVE-2026-91839

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed CR/LF characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile...

SUSE CVE-2026-100310

GNU libextractor before 1.16 loads plugins from an untrusted search path specified by the LIBEXTRACTORPREFIX environment variable without proper privilege checks. A local attacker can exploit this by setting LIBEXTRACTORPREFIX to a directory containing a malicious plugin that executes arbitrary...

CVE-2026-98025

A flaw was found in the Linux kernel's cx82310eth USB Ethernet driver. An attacker connecting a malicious USB device can trigger a heap-based buffer overflow by sending crafted packets containing a reboot indicator. Because the driver fails to discard the packet after detecting the reboot signal,...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...

EUVD-2024-55773

A code injection vulnerability has been discovered in the Robot Operating System 2 ROS 2 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing...

[SECURITY] [DSA 6527-1] rsync security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6527-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 28, 2026 https://www.debian.org/security/faq -...

CVE-2026-98016

A flaw was found in the Linux kernel's Mellanox network driver mlx5e. A race condition occurs during the concurrent teardown of traffic control TC sample rules sharing the same context, causing the system to reference memory after it has already been freed. A local user with network administrativ...

CVE-2026-86950

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS 18.7.11, iOS 26.7.1 and iPadOS 26.7.1, macOS Sequoia 15.8.1, macOS Tahoe 26.7.1. Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a...

CVE-2026-12717

A flaw was found in BigQuery Data Transfer Service. An authenticated attacker can achieve arbitrary code execution within the connector container by supplying crafted Java Database Connectivity JDBC connection string parameters. Successful exploitation can further allow the attacker to escalate...