Amazon Linux 2 : thunderbird (ALAS-2026-3952)

The version of thunderbird installed on the remote host is prior to 140.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3952 advisory. Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerabilit...

CVE-2026-100814: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

CVE-2026-100830: Origin Validation Error

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

CVE-2026-100825: Use After Free

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

GHSA-QW65-CVWX-89V3 fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

CLSA-2026-1790611274 pcs: Fix of 7 CVEs

CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...

CLSA-2026-1790610952 pcs: Fix of 7 CVEs

CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...

PT-2026-99924

Name of the Vulnerable Software and Affected Versions Langflow versions 0.0.94 through 1.11.x Langflow versions 1.0.16 through 1.11.x Description An unsafe eval function in schema.py allows authenticated attackers to achieve remote code execution. This occurs when a Python object containing a...

ROS-20260928-73-0037

The vulnerability of the Linux operating system’s kernel media component is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

Windows Imaging Component Code Execution

The vulnerability of the Windows Imaging Component WIC framework in the Windows operating system is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

ROS-20260928-73-0128

The vulnerability of the bpf component in the Linux operating system’s kernel is related to improper synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2021-34621-EXPLOIT

CVE-2021-34621 - Escalada de Privilegios en WordPress Se ha identificado una vulnerabilidad crítica en el componente de registro de usuarios del plugin ProfilePress para WordPress. Esta falla de seguridad, asignada con el CVE-2021-34621, permite a usuarios no autorizados registrarse en sitios web...

CVE-2026-100717

The froxlor server administration panel (versions 2.3.10 and earlier ) contains a CRLF injection vulnerability. The Validate::validateUrl component fails to inspect the userinfo (user:pass@) portion of a URL for carriage return and line feed characters. An authenticated low-privilege customer wit...

CVE-2026-79210

A flaw was found in the Audio component of Chromium, specifically in Google Chrome on Android. This use-after-free vulnerability allows a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to...

CVE-2026-79090

A flaw was found in chromium-browser. Improper privilege management in the Actor component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...

CVE-2026-79028

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the network component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-79109

A flaw was found in Google Chrome's printing component. A remote attacker, after compromising the renderer process, could exploit improper input validation by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security...

CVE-2026-79199

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By crafting a malicious HTML page, an attacker can gain unauthorized access within the network component...

CVE-2026-79125

A flaw was found in Google Chrome. This information leak vulnerability, specifically within the XR component, allows a remote attacker to obtain sensitive information. The attacker can achieve this by enticing a user to visit a specially crafted HTML page. This could lead to the unauthorized...

CVE-2026-79195

A flaw was found in Chromium. A remote attacker could exploit a use-after-free vulnerability within the Script component. By enticing a user to visit a specially crafted HTML page, the attacker could execute arbitrary code inside the sandbox...