CVE-2026-66046 Expat Denial of Service via storeAtts() Quadratic Complexity

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

CVE-2026-74986

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

EUVD-2026-60698

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74986 Site isolation issue in the CSS Parsing and Computation component

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74986

A site isolation flaw in Firefox/Thunderbird's CSS Parsing and Computation component allows cross-origin data leakage. NVD rates it CVSS 9.1 (network, no auth). No active exploitation confirmed; patch in Firefox 154, ESR 153.1, Thunderbird 154, and 153.1. Update affected browsers immediately.

CVE-2026-74986

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

RHSA-2026:55865 Red Hat Security Advisory: gstreamer1-plugins-bad-free and gstreamer1-plugins-ugly-free security update

Bulletin has no description...

EUVD-2026-60573

Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cowlink:link/1. cowlink:dolink/1 in cowlib interpolates the target URI, rel value, and attribute keys directly into the serialized Link: header valu...

CVE-2026-19484

A flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant...

PT-2026-77055

Name of the Vulnerable Software and Affected Versions Expat versions prior to 2.8.4 Description A denial of service issue exists due to quadratic algorithmic complexity within the storeAtts function in xmlparse.c. When processing N specified attributes with non-normalized values, the system...

RHEL 9 : redhat-ds:12 (RHSA-2026:56048)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56048 advisory. Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol...

Linux Distros Unpatched Vulnerability : CVE-2026-62982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and...

Linux Distros Unpatched Vulnerability : CVE-2026-68479

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: btrtl: validate firmware patch bounds rtlbtparsefirmware copies patchlength - 4 bytes before appending the firmware version. A malformed firmware pat...

PT-2026-77209

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

Amazon Linux 2 : containerd, --advisory ALAS2NITRO-ENCLAVES-2026-117 (ALASNITRO-ENCLAVES-2026-117)

The version of containerd installed on the remote host is prior to 2.1.9-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2NITRO-ENCLAVES-2026-117 advisory. A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. CVE-2026-56852 Tenable h...

Amazon Linux 2023 : perl-Date-Manip (ALAS2023-2026-2050)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2050 advisory. Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture year, month and day with th...

PT-2026-77161

libmodplug through 0.8.9.1 contains an out-of-bounds read in pat smplooped in src/load pat.cpp. The function validates only the upper bound of its sample index against MAXSMP and then subtracts one before indexing the 191-byte static array pat loops, so an index of zero reads pat loops-1, one byt...

PT-2026-77019

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A site isolation issue exists within the CSS Parsing and Computation component. Site isolation ...

Amazon Linux 2 : perl-Date-Manip, --advisory ALAS2-2026-3856 (ALAS-2026-3856)

The version of perl-Date-Manip installed on the remote host is prior to 6.41-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3856 advisory. Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeri...

PT-2026-77214

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.1, src/main/java/com/rabbitmq/client/impl/ValueReader.java permits ValueReader.readTable and ValueReader.readArray to call ValueReader.readFieldValue recursively f...