SAP Internet Graphics Server (IGS) - XML External Entity Injection

SAP Internet Graphics Servers IGS running versions 7.20, 7.20EXT, 7.45, 7.49, or 7.53 has two XML external entity injection XXE vulnerabilities within the XMLCHART page - CVE-2018-2392 and CVE-2018-2393. These vulnerabilities occur due to a lack of appropriate validation on the Extension HTML tag...

CVE-2026-116144

A flaw was found in ImageMagick. An attacker could cause a Denial of Service DoS by supplying a specially crafted Magick Vector Graphics MVG file. When processed, the file triggers uncontrolled recursion within the MVG decoder, exhausting stack memory and causing the application to crash...

CVE-2026-116148

A flaw was found in ImageMagick. The Magick Vector Graphics MVG encoder does not properly neutralize user-specified drawing options before writing them into generated output. An attacker capable of supplying drawing options can exploit this vulnerability to inject arbitrary drawing commands into...

firefox security update

An update is available for firefox. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

Rocky Linux 9 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource / firefox-x11 Multiple Vulnerabilities (crlsa-2026_76761)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676761 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in...

Rocky Linux 10.2 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76764)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676764 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free...

Rocky Linux 8 [CIQ] Security Update: firefox / firefox-debuginfo / firefox-debugsource Multiple Vulnerabilities (crlsa-2026_76850)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202676850 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in...

RHEL 9 : thunderbird (RHSA-2026:85244)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:85244 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Use-after-free in the Graphics: Canvas...

RockyLinux 10 : firefox (RLSA-2026:76764)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:76764 advisory. firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free...

CVE-2026-109710

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Graphics: Text component...

CVE-2026-109765

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Race condition, use-after-free in the Graphics: Text component...

CVE-2026-109719

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Race condition, use-after-free in the Graphics: CanvasWebGL component...

CVE-2026-91381

A flaw was found in OpenJDK. This vulnerability allows an unauthenticated remote attacker to cause unauthorized data modification or deletion by submitting untrusted input to APIs in the 2D graphics component. Exploitation can occur through network services that pass data to these APIs or in clie...

CVE-2026-113163

A flaw was found in chromium-browser. A use-after-free memory vulnerability in the Web Graphics Library WebGL component allows a remote attacker to execute arbitrary code within the application sandbox. By tricking a user into visiting a maliciously crafted web page, an attacker can exploit...

CVE-2026-114044 FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFXMAPSURFACETOWINDOWPDU with oversized...

CVE-2026-114044

FreeRDP versions prior to 3.32.1 are vulnerable to a heap out-of-bounds read in the Android client graphics pipeline. The root cause is the use of unvalidated mappedWidth and mappedHeight values. A malicious RDP server can send a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized dimensions,...

CVE-2026-114044 FreeRDP before 3.32.1 Android Client Heap OOB Read via Graphics Pipeline

FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP servers to read beyond surface buffers by supplying unvalidated mappedWidth and mappedHeight values. Attackers can send a crafted RDPGFXMAPSURFACETOWINDOWPDU with oversized...

Linux Distros Unpatched Vulnerability : CVE-2026-109712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sandbox escape due to uninitialized memory in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5,...

Linux Distros Unpatched Vulnerability : CVE-2026-109719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Race condition, use-after-free in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5,...

Linux Distros Unpatched Vulnerability : CVE-2026-109730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird...