CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Firefox 157...

CVE-2026-100804 Sandbox escape due to use-after-free in the Preferences: Backend component

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

CVE-2026-100804

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

EUVD-2026-88957

Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Firefox 157...

CVE-2026-100804

The Firefox browser is affected by a sandbox escape vulnerability caused by a use-after-free flaw in the Preferences: Backend component. This issue allows for potential sandbox circumvention, and the vulnerability was resolved in Firefox 157 . No specific exploit details or in-the-wild exploitati...

BIT-ENVOY-2026-73548 Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete...

CVE-2026-102293

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack ...

EUVD-2026-88643

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack ...

CVE-2026-102293

A vulnerability exists in realjerrytang tacomall 1.0.0 within the api-admin Backend component. Specifically, the OrgStaffServiceImpl.add function in the ApiMaApplication.java file is susceptible to improper authorization when the isAdmin/jobId arguments are manipulated. This flaw allows for remot...

Amazon Linux 2023 : libssh, libssh-config, libssh-devel (ALAS2023-2026-3096)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3096 advisory. A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and...

Amazon Linux 2 : gvfs (ALAS-2026-3943)

The version of gvfs installed on the remote host is prior to 1.36.2-3. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3943 advisory. A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply t...

CVE-2026-102634: Use of Multiple Resources with Duplicate Identifier

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstraproom fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstraproom values to crash scheduler processes or hang oth...

PT-2026-102578

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Thunderbird versions prior to 157 Description A use-after-free issue exists in the Preferences: Backend component, which can lead to a sandbox escape. A use-after-free occurs when a program continues to use a...

PT-2026-102682

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.21 Description When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the software fails to validate duplicate bootstrap room fields in the '/generate' endpoint. Unauthenticated...

Important: gvfs

Issue Overview: A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that exceeds the size requested by the client. The function does not verify the server-provided length against the allocated buff...

PT-2026-102639

Name of the Vulnerable Software and Affected Versions Weblate versions 4.11.1 through 2026.7.1 Description An argument-injection flaw exists in the Mercurial backend of this web-based continuous localization platform. Repository filenames starting with a hyphen - may be interpreted as Mercurial...

PT-2026-102453

Name of the Vulnerable Software and Affected Versions realjerrytang tacomall version 1.0.0 Description An improper authorization issue exists in the api-admin Backend component within the file ApiMaApplication.java. The flaw occurs in the OrgStaffServiceImpl.add function, where manipulating the...

CVE-2026-102293: Improper Authorization

A vulnerability was identified in realjerrytang tacomall 1.0.0. Impacted is the function OrgStaffServiceImpl.add of the file ApiMaApplication.java of the component api-admin Backend. The manipulation of the argument isAdmin/jobId leads to improper authorization. Remote exploitation of the attack ...

CVE-2026-86035: Improper Neutralization of Special Elements used in an OS Command

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal...

CVE-2026-86158: Missing Authentication for Critical Function

Missing authentication in the local .NET backend Fiddler.WebUi of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticated attacker to mint OAuth tokens and read the machine-in-the-middle root certificate through an unauthenticated localhost HTTP and SignalR RPC channel...