PT-2026-37601

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The TSV110 processor is susceptible to the Spectre-BHB Branch History Buffer attack. This issue allows for the leakage of information via branch prediction side channels, which are...

Important: thunderbird

Issue Overview: Race condition in the Graphics component. This vulnerability affects Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30. CVE-2025-13012 Mitigation bypass in the DOM: Core & HTML component. This vulnerability affects Firefox 145, Firefox ESR 140.5, and Firefox ESR 115.30...

CVE-2026-21444

A flaw was found in libtpms, a library for Trusted Platform Module TPM emulation. An attacker with low privileges could exploit this vulnerability when libtpms is integrated with OpenSSL 3.x and certain symmetric ciphers are used. The library incorrectly returns the initial Initialization Vector ...

CVE-2025-11964

A flaw was found in libpcap on Windows. When libpcap converts a Windows error message containing 4-byte UTF-8 characters, the utf16letoutf8truncated function can write data beyond its allocated buffer. This out-of-bounds write can lead to data corruption, impacting the integrity of the system...

CVE-2025-15276

A flaw was found in FontForge. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted SFD file. This issue arises from improper validation of user-supplied data during SFD file parsing, leading to deserialization of untrusted data. Successful exploitatio...

CVE-2025-15272

A flaw was found in FontForge. This heap-based buffer overflow vulnerability allows a remote attacker to execute arbitrary code on the system. The flaw occurs during the parsing of SFD Spline Font Database files due to insufficient validation of user-supplied data length. Successful exploitation...

Advanced Vulnerability Scanning for Open Source Software: Detection and Mitigation of Log4j Vulnerabilities

Automated detection of software vulnerabilities remains a critical challenge in software security. Log4j is an industrial-grade Java logging framework listed as one of the top 100 critical open source projects. On Dec. 10, 2021 a severe vulnerability Log4Shell was disclosed before being fully...

PT-2026-21724

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 Description A mitigation bypass exists in the Networking: Cache component. This issue may allow bypassing...

PT-2026-27399

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 149 Firefox ESR versions prior to 140.9 Thunderbird versions prior to 149 Thunderbird versions prior to 140.9 Description A mitigation bypass exists in the Networking: HTTP component. This issue could allow bypassing...

PT-2026-29086

Name of the Vulnerable Software and Affected Versions GNU C Library versions 2.43 and earlier Description The iconv function in the GNU C Library may experience a crash due to an assertion failure when processing inputs from the IBM1390 or IBM1399 character sets. This could potentially be exploit...

PT-2026-21717

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Firefox ESR versions prior to 140.8 Thunderbird versions prior to 148 Thunderbird versions prior to 140.8 Description A mitigation bypass exists in the DOM within the Security component. This issue impacts Firefox...

CVE-2025-69202

Axios Cache Interceptor is a cache interceptor for axios. Prior to version 1.11.1, when a server calls an upstream service using different auth tokens, axios-cache-interceptor returns incorrect cached responses, leading to authorization bypass. The cache key is generated only from the URL, ignori...

CVE-2025-69257

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom Python rules and configuration files from user-writable locations e.g., /.config/theshit/ without validating ownership or permissions when...

CVE-2025-69211

Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses @nestjs/platform-fastify; relies on NestMiddleware via MiddlewareConsumer for security checks...

CVE-2022-50815 ext2: Add sanity checks for group and filesystem size

In the Linux kernel, the following vulnerability has been resolved: ext2: Add sanity checks for group and filesystem size Add sanity check that filesystem size does not exceed the underlying device size and that group size is big enough so that metadata can fit into it. This avoid trying to mount...

CVE-2025-69217

A flaw was found in coturn. A remote attacker can exploit a predictable random number generator used for nonces and port randomization. By sending a series of unauthenticated requests, an attacker can reconstruct the random number generator's state, allowing them to predict future nonces and port...

PT-2025-54217

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom Python rules and configuration files from user-writable locations e.g., /.config/theshit/ without validating ownership or permissions when...

CVE-2025-66865

A flaw was found in binutils. Processing a specially crafted PE file with cxxfilt can trigger a stack overflow in the dprintcompinner function in the cp-demangle.c file, causing a crash and resulting in a denial of service. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-69195

A flaw was found in GNU Wget2. This vulnerability, a stack-based buffer overflow, occurs in the filename sanitization logic when processing attacker-controlled URL paths, particularly when filename restriction options are active. A remote attacker can exploit this by providing a specially crafted...

Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation

The software supply chain attacks are becoming more and more focused on trusted development and delivery procedures, so the conventional post-build integrity mechanisms cannot be used anymore. The available frameworks like SLSA, SBOM and in toto are majorly used to offer provenance and traceabili...