8686 matches found
Mozilla Thunderbird < 140.13
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 140.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-72 advisory. - Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed...
PT-2026-63394
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting XSS attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this...
CVE-2026-65317
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...
CVE-2026-65317
Verba RAG application 2.1.3 is affected by a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. An unauthenticated attacker can issue arbitrary outbound HTTP requests by supplying a crafted Origin header and attacker-controlled host/port values to the ...
CVE-2026-65317
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...
CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass
Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...
CVE-2026-16381
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16349
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16349
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16381
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
UBUNTU-CVE-2026-16349
Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
UBUNTU-CVE-2026-16381
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16381
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16381
A Same-origin policy bypass exists in the Networking: DNS component of the Firefox and Thunderbird web browser and mail client. This vulnerability was resolved in Firefox 153 , Firefox ESR 140.13 , Thunderbird 153 , and Thunderbird 140.13 . Exploitation details are not provided in the documents, ...
CVE-2026-16381 Same-origin policy bypass in the Networking: DNS component
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16381
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
CVE-2026-16381 Same-origin policy bypass in the Networking: DNS component
Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...
