PT-2026-76971

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A mitigation bypass exists within the JavaScript: GC Garbage Collector component. The Garbage...

KLA91229 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability in t...

CVE-2026-74938: Protection Mechanism Failure

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101283 advisory. Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101145 advisory. Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-100976)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100976 advisory. Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Tenable has...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101150)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101150 advisory. Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Tenable has...

AZL-96341 CVE-2026-72434 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

UBUNTU-CVE-2026-68459

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix potential deadlock in gcmerge path of f2fsbalancefs When we mount device w/ gcmerge mount option, we may suffer below potential deadlock: Kworker GC trehad Truncator - f2fswritecachepages - f2fswritesingledatapage -...

CVE-2026-72434 netfilter: ipset: make sure gc is properly stopped

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

PT-2026-72171

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential deadlock exists in the f2fs balance fs function when the device is mounted with the gc merge option. The issue occurs due to a circular dependency between a Kworker, a GC...

CVE-2026-72434: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

K000162799: Linux Kernel vulnerability CVE-2026-63798

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe and sets up chained handlers...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-2014)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2014 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix...

SUSE CVE-2026-63798

In the Linux kernel, the following vulnerability has been resolved: irqchip/imgpdc: Fix resource leak, add missing chained handler cleanup on remove The driver allocates domain generic chips using irqallocdomaingenericchips during probe and sets up chained handlers using...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the ArtifactGC.PodSpecPatch handling in workflow/util/merge.go. An attacker can override the artifact-GC pod’s spec by submitting a Workflow with...

CVE-2026-54526

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-54526

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...

CVE-2026-54526 Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactGC.PodSpecPatch bypass of Strict/Secure templateReferencing

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because workflow/util/merge.go ValidateUserOverrides and SanitizeUserWorkflowSpec walk only the top-level...