CVE-2026-100769: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

CVE-2026-100772: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, and Firefox ESR 140.17...

CVE-2026-100783: Use of Uninitialized Variable

Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100785: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100790: Use After Free

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100791: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100774: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100821: Origin Validation Error

Site isolation issue in the Panning and Zooming component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

CVE-2026-100829: Protection Mechanism Failure

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

CVE-2026-100791: Use After Free

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17...

PT-2026-102834

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 154.0.8037.92 Description An out of bounds write occurs in the GPU component. This issue allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside th...

CVE-2026-100814: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

Amazon Linux 2 : thunderbird (ALAS-2026-3952)

The version of thunderbird installed on the remote host is prior to 140.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3952 advisory. Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerabilit...

Amazon Linux 2 : firefox (ALASFIREFOX-2026-065)

The version of firefox installed on the remote host is prior to 140.16.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2026-065 advisory. Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 15...

GHSA-QW65-CVWX-89V3 fast-uri vulnerable to authority injection via an unvalidated port in serialize

Impact fast-uri serializes the port component of a URI without validating it. When recomposing the authority, fast-uri escapes the userinfo and host components but concatenates the port verbatim, so a port value that is not a sequence of digits can inject authority delimiters. For example,...

CLSA-2026-1790611274 pcs: Fix of 7 CVEs

CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...

CLSA-2026-1790610952 pcs: Fix of 7 CVEs

CVE-2022-1049: fix pcsd PAM auth accepting expired accounts and passwords - CVE-2022-38900: fix DoS in decode of bundled decode-uri-component - CVE-2022-45442: fix reflected file download in bundled sinatra attachment - CVE-2023-27530: fix multipart part count DoS in rack via rack 2.2.20 -...

ROS-20260928-73-0037

The vulnerability of the Linux operating system’s kernel media component is related to the use of an uninitialized resource. Exploiting this vulnerability can allow a perpetrator to cause a service failure...

PT-2026-99924

Name of the Vulnerable Software and Affected Versions Langflow versions 0.0.94 through 1.11.x Langflow versions 1.0.16 through 1.11.x Description An unsafe eval function in schema.py allows authenticated attackers to achieve remote code execution. This occurs when a Python object containing a...

ROS-20260928-73-0128

The vulnerability of the bpf component in the Linux operating system’s kernel is related to improper synchronization. Exploiting this vulnerability can allow an attacker to cause a service failure...