firefox: thunderbird: Mitigation bypass in the Safe Browsing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock. Since DMAfence objects can be shared with other subsystems, they may be accessed from the hardirq context in those drivers. We must take that into accoun...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Driver: soc: xilinx – Use a safe loop iterator to avoid a use after free. The hashforeachpossible loop dereferences evedata to obtain the next item in the list. However, the loop frees evedata, leading to a use after free. Instea...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: PM: domains: Fixed a sleep-in-atomic bug caused by genpddebugRemove When a genpd with GENPDFLAGIRQSAFE is removed, the following sleep-in-atomic bug will occur, as genpdDebugRemove will be called with a spinlock held. 0.029183 BU...

firefox: thunderbird: Mitigation bypass in the Safe Browsing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

firefox: thunderbird: Mitigation bypass in the Safe Browsing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

SUSE CVE-2026-74957

Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-74957

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

CVE-2026-63654 Frappe: Unauthenticated Workflow approval via confirm_action

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

CVE-2026-63654

Frappe (full-stack web application framework) versions 16.31.0 and earlier contain a vulnerability in the frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py. The whitelisted endpoint is not restricted to POST , meaning it accepts safe HTTP methods (e.g., GET) for st...

EUVD-2026-63538

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

CVE-2026-76833

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

CVE-2026-76833

The @cgauge/yaml npm package has a custom YAML tag handler that unconditionally calls eval() on attacker-supplied string values during document parsing. Any application that parses untrusted YAML with this library exposes full Node.js runtime authority — environment variables, filesystem read/wri...

EUVD-2026-63350

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

CVE-2026-76833 @cgauge/yaml npm Package Arbitrary Code Execution via eval() YAML Tag

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval on attacker-supplied string values during document parsing. Any application...

EUVD-2026-62936

In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...

CVE-2026-63654: Cross-Site Request Forgery (CSRF)

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulkworkflowapproval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

PT-2026-79101

Name of the Vulnerable Software and Affected Versions django CMS versions 5.0.8 through 5.0.8 Description In edit mode, the ContentRenderer.render placeholder function in cms/plugin rendering.py can pass stored, attacker-controlled values to the ContentRenderer.render exception function when plug...

PT-2026-79106

Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk workflow approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An...

CVE-2026-76372 Incorrect Permission Assignment through Safe Mode in Nmap Scanner for Splunk SOAR

In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system...