CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

PT-2026-102591

Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

PT-2026-102423

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.62 Description Stored cross-site scripting exists in the IMAP OAuth connector. The issue occurs because MIME-encoded email subjects are double-decoded after HTML escaping. Unauthenticated attackers can send crafte...

CVE-2026-100817: Undefined Security Weakness

Other issue in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

CVE-2026-100825: Use After Free

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

CVE-2026-100814: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

PT-2026-102645

🚨 CVE-2026-102630 UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect...

PT-2026-102567

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An issue exists in the JavaScript Engine component involving JIT Just-In-Time miscompilation. JIT is a method of improving program performance by compiling code during...

CVE-2026-100796: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

CVE-2026-100813: Release of Invalid Pointer or Reference

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

CVE-2026-100765: Use After Free

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

PT-2026-102539

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a memory corruption flaw that occurs when...

PT-2026-102550

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102588

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description Incorrect boundary conditions exist within the JIT Just-In-Time component of the JavaScript Engine. JIT is a method of improving...

PT-2026-102587

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 157 Firefox versions prior to 157 Description An invalid pointer issue exists within the Just-In-Time JIT component of the JavaScript Engine. JIT is a method of improving program performance by compiling code duri...

Linux Distros Unpatched Vulnerability : CVE-2026-101912

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in...

PT-2026-102444

Name of the Vulnerable Software and Affected Versions pbkdf2 versions prior to 3.1.7 Description The JavaScript fallback in lib/sync.js re-hashes passwords that exceed the digest's block size 64 bytes, or 128 bytes for sha384 and sha512 during every iteration. This occurs because the password is...

CVE-2026-100793: Access of Resource Using Incompatible Type

JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157...

PT-2026-102543

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102562

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description An invalid pointer issue exists within the JavaScript: WebAssembly component. WebAssembly is a...