org.jenkins-ci.plugins:templating-engine (>=1.6, <=2.2.1.1) potentially affected by CVE-2026-57285 via org.jenkins-ci.plugins:github-branch-source (2.5.1)

org.jenkins-ci.plugins:github-branch-source MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.plugins:github-branch-source and may be impacted: - org.jenkins-ci.plugins:templating-engine =1.6, =2.2.1.1 Source cves:...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Pipeline Snippet Generator. An attacker can instantiate types related to job or system configuration other than Pipeline steps by tricking a user with the necessary permissions into submitting a...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fixed an issue where engid could be negative, causing the streamenc regs array to be indexed out of bounds. The variable engid is used directly as an index into the streamenc regs array, which has only 5 elements...

Astra Linux – Vulnerability in Firefox

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 149 and Thunderbird 149...

Astra Linux – Vulnerability in Firefox, Thunderbird

Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...

Astra Linux – Vulnerability in Firefox, Thunderbird

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox, Thunderbird

Invalid pointer in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox, Thunderbird

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox, Thunderbird

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7...

Astra Linux – Vulnerability in Firefox, Thunderbird

Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox, Thunderbird

Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

Astra Linux – Vulnerability in Firefox, Thunderbird

JIT compilation errors, use-after-free in the JavaScript Engine: JIT components. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CVE-2025-71382

A flaw was found in MuPDF. A remote attacker can exploit an uncontrolled recursion vulnerability in the EPUB CSS rendering engine by supplying a maliciously crafted EPUB file. This file, containing deeply nested HTML elements and inline CSS styles, causes the valuefrominheritableproperty function...

CVE-2026-53046: Use After Free

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine ksmbdcryptmessage sets a NULL completion callback on AEAD requests and does not handle the -EINPROGRESS return code from async hardware crypto engines like the...

PT-2026-56651

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.115 Description An uninitialized use in the V8 engine allows a remote attacker to execute arbitrary code within a sandbox by using a specially crafted HTML page. V8 is the open-source JavaScript and...

ROS-20260624-73-0005

The vulnerability of the swfdefbitsjpeg function in the MP4Box packaging engine of the GPAC multimedia platform is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2026-54070: Improper Neutralization of Input During Web Page Generation

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, renderPackageREADME in kernel/bazaar/readme.go renders a Bazaar package README from Markdown to HTML with the lute engine and SetSanitizetrue. The lute sanitizer is an event-handler blocklist: allowAttr rejects only...

PT-2026-51940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ksmbd crypt message function when using asynchronous hardware crypto engines, such as the Qualcomm Crypto Engine QCE. The function sets a NULL...

Oracle Access Manager Authentication Engine Privilege Escalation

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain read, modify, or delete privileges on data...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6433 more potentially affected by CVE-2026-54515 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...