PT-2026-61919

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Service Workers component. Service Workers are scripts that the browser runs in the background, separate from a web page,...

PT-2026-61902

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A mitigation bypass exists within the Enterprise Policies component. Recommendations Update...

PT-2026-61889

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A mitigation bypass exists within the PDF Viewer component. Recommendations Update Firefox to...

PT-2026-61882

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the DOM: Networking component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61892

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A mitigation bypass exists within the Networking component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-58055

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections...

PT-2026-61590

⚠️ Linux Fast Datapath for RHEL 9 alert: CVE-2026-14957 CVSS 7.5 Refer to the vendor advisory for the confirmed security impact. Apply the vendor-recommended mitigation. https://t.co/9ZyL1YrKE5 Linux FastDatapathforRHEL9 CyberSecurity CVE...

CVE-2026-53377 drm/msm: always recover the gpu

In the Linux kernel, the following vulnerability has been resolved: drm/msm: always recover the gpu Previously, in case there was no more work to do, recover worker wouldn't trigger recovery and would instead rely on the gpu going to sleep and then resuming when more work is submitted...

CVE-2026-14957

A flaw was found in Libreswan. An unauthenticated remote attacker can send a specially crafted X.509 certificate payload during an IKEv1 or IKEv2 exchange. This flaw occurs when Libreswan is operating in FIPS Federal Information Processing Standards mode and processing a certificate with an inval...

CVE-2026-16108

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

CVE-2026-41853

A flaw was found in Spring MVC and WebFlux applications, components of the Spring Framework. This vulnerability allows a remote, unauthenticated attacker to perform Multipart request smuggling attacks. Such an attack can lead to a low integrity impact, potentially enabling the attacker to bypass...

CVE-2026-41851

A flaw was found in Spring Framework. Applications that accept user-supplied Spring Expression Language SpEL expressions may be vulnerable to a Denial of Service DoS attack. This occurs if the evaluation of a SpEL expression triggers unbounded cache growth, consuming excessive resources and makin...

CVE-2026-38755

A flaw was found in Busybox. A heap overflow vulnerability in the evalcommand function allows attackers to cause a Denial of Service DoS by supplying a specially crafted input. This can lead to the unavailability of the service. Mitigation Mitigation for this issue is either not available or the...

CVE-2026-38752

A flaw was found in BusyBox. This vulnerability, a stack overflow in the evaluate function, allows a remote attacker to cause a Denial of Service DoS by providing a specially crafted AWK script. A Denial of Service attack can make the affected system or application unavailable to legitimate users...

CVE-2026-47083

A flaw was found in Cyrus IMAP. An authenticated user can exploit the ESEARCH command to discover the existence of folder names belonging to other user accounts. This vulnerability leads to information disclosure, allowing an attacker to gain unauthorized knowledge about the structure of other...

CVE-2026-47085

A flaw was found in Cyrus IMAP cyrus-imapd. A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. This could allow the attacker to gain unauthorized read access to a victim's mailbox. The likelihood of exploitation is low due to the...

CVE-2026-59733

A flaw was found in Rclone. When using the rclone serve restic --private-repos command, an authenticated user can include directory traversal sequences e.g., .. in a request. This allows them to bypass authorization and read, overwrite, or delete another user's private repository on backends that...

CVE-2026-47428

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the...

CVE-2026-15809

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...