CVE-2023-6867 vulnerabilities

Vulnerabilities for packages: firefox-esr...

CVE-2026-55510

creationtimestamp| type| source ---|---|--- 2026-07-01 20:05:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mpmcuixr5u2q 2026-07-02 11:56:08+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnxz7kr5g2w 2026-07-03 13:25:03+00:00| seen|...

CVE-2026-13879

creationtimestamp| type| source ---|---|--- 2026-07-01 19:59:50+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmckvnwbg2i 2026-07-02 07:22:09+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:17:42+00:00| seen|...

CVE-2026-13808

creationtimestamp| type| source ---|---|--- 2026-07-01 19:58:48+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmcj2exul2b 2026-07-02 01:10:18+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmtwdsjug2b 2026-07-02 07:19:21+00:00| seen|...

sigstore-js has Insufficient Verification of Data Authenticity

sigstore-js derives a transparency-log timestamp from tlogEntries.integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a tlog entry can be inclusionProof-only no signed inclusionPromise/set, and the inclusion proof path does not...

CVE-2026-13812

creationtimestamp| type| source ---|---|--- 2026-07-01 19:50:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbzmsevo2t 2026-07-02 01:30:21+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmv27cvmp2b 2026-07-02 07:19:30+00:00| seen|...

CVE-2026-13811

creationtimestamp| type| source ---|---|--- 2026-07-01 19:48:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbw2ej462q 2026-07-02 07:19:28+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-02 12:26:39+00:00| seen|...

CVE-2026-13823

creationtimestamp| type| source ---|---|--- 2026-07-01 19:44:46+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmbqawdnw2t 2026-07-02 07:19:54+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:15:53+00:00| seen|...

CVE-2026-36541

creationtimestamp| type| source ---|---|--- 2026-07-01 19:37:03+00:00| seen| https://gist.github.com/justinbrick/fad199753a9a4afbaddda05651a45d15...

CVE-2026-36542

creationtimestamp| type| source ---|---|--- 2026-07-01 19:37:03+00:00| seen| https://gist.github.com/justinbrick/fad199753a9a4afbaddda05651a45d15...

vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass

A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or furth...

Integer Overflow or Wraparound

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

External Control of File Name or Path

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

External Control of File Name or Path

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

External Control of File Name or Path

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

DEBIAN-CVE-2026-55594

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and...

CVE-2026-54164 API Platform Core: Missing IRI type check enables resource type confusion

API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions prior to 4.1.30, 4.2.26 and 4.3.12, the serializer's AbstractItemNormalizer does not validate the resource type returned when resolving relation IRIs, allowing type confusion where a resource of an...

CVE-2026-55594

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-51 and 7.1.2-26, a missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided. This issue has been fixed in versions 6.9.13-51 and...

GHSA-MJGF-XJ26-9QF9 pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier

Summary Pay::Webhooks::PaddleBillingControllervalidsignature? app/controllers/pay/webhooks/paddlebillingcontroller.rb verifies the Paddle Billing webhook signature by computing OpenSSL::HMAC.hexdigest... and comparing it to the attacker-supplied header value using Ruby's String==. Ruby's == is...

CVE-2026-55577

CVE-2026-55577 affects ImageMagick's MVG decoder. A heap buffer overflow can cause an out-of-bounds write when processing crafted MVG images. Affected versions are prior to 6.9.13-51 and 7.1.2-26. The issue has been fixed in 6.9.13-51 and 7.1.2-26. Mitigation:** upgrade to one of the fixed releas...