CVE-2026-84119

Mozilla Firefox and Thunderbird are affected by a sandbox escape vulnerability caused by a use-after-free in the DOM: Navigation component . This security issue can lead to the execution of arbitrary code or privilege escalation. Remediation includes updating to Firefox 155 , Firefox ESR 115.40 ,...

CVE-2026-84119

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

EUVD-2026-69064

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-84119 Sandbox escape due to use-after-free in the DOM: Navigation component

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

CVE-2026-84119

Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2...

vm2 v3.11.8

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation npm install vm2 Quick Examples import VM from...

Moderate: Red Hat Security Advisory: tar security, bug fix, and enhancement update

An update for tar is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

RLSA-2026:61581 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

tar security, bug fix, and enhancement update

An update is available for tar. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The GNU tar program can save multiple files in an archive and restore files from ...

PT-2026-84357

Name of the Vulnerable Software and Affected Versions OpenAI Codex Desktop for Windows and macOS affected versions not specified Description The application automatically inspects Git metadata and working-tree status upon opening a workspace. If a workspace contains a repository with a malicious...

PT-2026-84563

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A use after free issue exists in Shared Tab Groups. A remote attacker can leverage social engineering to execute arbitrary code outside the sandbox by inducing a user to visi...

PT-2026-84556

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the TabStrip component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This requires the attacker to have already...

RHEL 10 : tar (RHSA-2026:61586)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61586 advisory. The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injecti...

PT-2026-84564

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the FileSystem component allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to entice a...

PT-2026-84555

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in Chromoting on Windows allows a local attacker to execute arbitrary code outside the sandbox through a local program. Recommendations Update Google Chrome to...

tar security, bug fix, and enhancement update

2:1.34-13 - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary directory at an archive-controlled path outside the extraction tree. The fix for CVE-2025-45582 already prevents exploiting this problem, so i...

PT-2026-84354

Name of the Vulnerable Software and Affected Versions OpenAI Codex Desktop for Windows and macOS affected versions not specified Description OpenAI Codex Desktop can execute attacker-controlled Git hooks due to automated Git operations trusting the repository local core.hooksPath setting. If a us...

PT-2026-84562

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description A use after free issue exists in WebGL, which occurs when a program continues to use a pointer after it has been freed. This allows a remote attacker to execute arbitrary cod...