firefox: Sandbox escape due to use-after-free in the DOM: Security component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Security component...

firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Core & HTML component...

firefox: thunderbird: Sandbox escape in the Remote Settings Client component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Remote Settings Client component...

CVE-2026-14780: Improper Control of Generation of Code

A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that...

ALSA-2026:71652 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component CVE-2026-92024 firefox: thunderbird: Mitigation bypass in the Remote Settings Client component CVE-2026-92019...

RHEL 9 : thunderbird (RHSA-2026:70642)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:70642 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Worke...

MiracleLinux 9 : firefox-140.15.0-1.el9_8.ML.1 (AXSA:2026-1912:23)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1912:23 advisory. firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings...

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component CVE-2026-92024 firefox: thunderbird: Mitigation bypass in the Remote Settings Client component CVE-2026-92019...

RHEL 8 : firefox (RHSA-2026:71652)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71652 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

MiracleLinux 9 : webkit2gtk3-2.54.0-1.el9_8 (AXSA:2026-1904:08)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1904:08 advisory. chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page CVE-2026-19154 chromium-browser: skia: Skia: Sandbox escape via...

CVE-2021-3156

CVE-2021-3156 概述 Heap-based buffer overflow in Sudo CVE-2021-3156 由于sudo转义\不当而造成的堆溢出漏洞，LPE 影响范围 从1.8.2到1.8.31p2的所有版本 从1.9.0到1.9.5p1的所有稳定版本 检测命令 sudoedit -s '' perl -e 'print "A" x 65536' 如果出现类似Segmentation fault core dumped即表明存在漏洞 相关文献...

CVE-2026-86583 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

CVE-2026-93421

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

CVE-2026-84683

A vulnerability exists in Red Hat Ansible Automation Platform's automation-controller where the HTML view of job, ad hoc command, project update, and inventory update standard outputs fails to remove ANSI terminal escape sequences before HTML conversion. Specifically, an ANSI OSC 8 hyperlink sequ...

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...

CVE-2026-93421

The Mesop Python-based UI framework is vulnerable to an unauthenticated ANSI escape sequence injection in the /__csp__ endpoint. The csp_report handler in mesop/server/static_file_serving.py processes attacker-controlled JSON fields (such as blocked-uri and document-uri) and prints them directly ...

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

firefox security update

An update is available for firefox. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

RLSA-2026:69462 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Use-after-free in the SVG component CVE-2026-92024 firefox: thunderbird: Mitigation bypass in the Remote Settings Client component CVE-2026-92019...