Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: MFSA 2026-05 bsc1256340: CVE-2026-0877: Mitigation bypass in the DOM in Security component CVE-2026-0878: Sandbox escape due to incorrect boundary conditions in the Graphics in CanvasWebGL component CVE-2026-0879: Sandbox escape due t...

Code execution vulnerability in multiple Mozilla products (CNVD-2026-11802)

Mozilla Firefox is an open source web browser from the Mozilla Foundation.Mozilla Firefox ESR is an extended support version of Firefox web browser from the Mozilla Foundation.Mozilla Thunderbird is a suite of e-mail client software from the Mozilla Foundation that is separate from the Mozilla...

MiracleLinux 3 : kernel-2.6.18-194.3.AXS3 (AXSA:2010-377:12)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2010-377:12 advisory. The kernel package contains the Linux kernel vmlinuz, the core of any Linux operating system. The kernel handles the basic functions of the operating...

AlmaLinux 10 : cups (ALSA-2026:0464)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0464 advisory. CUPS: Local denial-of-service via cupsd.conf update and related issues CVE-2025-61915 cups: Slow client communication leads to a possible DoS attack...

AlmaLinux 8 : cups (ALSA-2026:0596)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:0596 advisory. CUPS: Local denial-of-service via cupsd.conf update and related issues CVE-2025-61915 cups: Slow client communication leads to a possible DoS attack...

CVE-2026-23733

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting XSS vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Executi...

CVE-2026-23733

LobeChat desktop (open source) is affected by a stored XSS in the Mermaid artifact renderer prior to version 2.0.0-next.180. The XSS can be escalated to Remote Code Execution (RCE) by abusing the exposed electronAPI IPC bridge, enabling arbitrary system commands in the victim’s machine. Version 2...

MAL-2026-323 Malicious code in eslint-plugin-fuel-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99675eb06a245907c7a2133cf7d75af3037229a059d0a135bf8c3d518432a6a4 The package eslint-plugin-fuel-react was found to contain malicious code. Source: ossf-package-analysis...

OESA-2026-1090 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. %if 0 %global mozdebugprefix /lib/debug %global mozdebugdir /lib/debug/ %global unamem %uname -m %global symbolsfilename -.en-US.-%uname.crashreporter-symbols.zip %global symbolsfilepath...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003685)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003685 advisory. A NULL pointer dereference vulnerability in the function nfcgenldeactivatetarget in net/nfc/netlink.c in the Linux kernel before 5.1.13 can be triggered by a malicio...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004075)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004075 advisory. A missing CAPNETRAW check in NFC socket creation in net/nfc/rawsock.c in the Linux kernel before 5.8.2 could be used by local attackers to create raw sockets,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000671)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000671 advisory. Multiple stack-based buffer overflows in the Near Field Communication Controller Interface NCI in the Linux kernel before 3.4.5 allow remote attackers to cause a...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000547 advisory. The iucvsockrecvmsg function in net/iucv/afiucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtai...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003651)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003651 advisory. An issue was discovered in the Linux kernel before 4.20.15. The nfcllcpbuildtlv function in net/nfc/llcpcommands.c may return NULL. If the caller does not check for...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001475)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001475 advisory. A flaw was found in the Linux kernel. A use-after-free vulnerability in the NFC stack can lead to a threat to confidentiality, integrity, and system availability...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003930)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003930 advisory. In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003735)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003735 advisory. An issue was discovered in the Linux kernel before 4.20.15. The nfcllcpbuildtlv function in net/nfc/llcpcommands.c may return NULL. If the caller does not check for...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004296 advisory. In the Linux kernel before 5.3.9, there is a use-after-free bug that can be caused by a malicious USB device in the drivers/nfc/pn533/usb.c driver, aka...

CVE-2025-71079

In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfcunregisterdevice and rfkillfopwrite A deadlock can occur between nfcunregisterdevice and rfkillfopwrite due to lock ordering inversion between devicelock and rfkillglobalmutex. The problematic lo...

firefox: thunderbird: Use-after-free in the IPC component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the IPC component...