EUVD-2026-78165

A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used...

KVM-Januscape

KVM-XJ: parche en caliente dumptool.py encuentra los offsets automáticamente; para saber cómo usarlo, lee el código tú mismo. Resumen de la vulnerabilidad CVE-2026-53359 Januscape es una vulnerabilidad de use-after-free UAF en el MMU sombra de KVM del kernel de Linux. Tiempo latente: 16 años agos...

RHEL 8 : kernel (RHSA-2026:67468)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67468 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: EDAC/bluefield: Fix potential...

AlmaLinux 8 : kernel (ALSA-2026:67468)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67468 advisory. kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address CVE-2025-711...

RockyLinux 9 : kernel (RLSA-2026:67150)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:67150 advisory. kernel: Linux kernel: Denial of Service in qla2xxx SCSI driver due to improper command handling after chip reset CVE-2025-68745 kernel: drm/xe: Open-cod...

ALSA-2026:67469 Important: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast addre...

PT-2026-91957

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16...

PT-2026-91849

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx.loadDict of the file ZstdCompressCtx.java of the component Dictionary Sharing. Such manipulation leads to use after free. The attack can be executed remotely. The exploit has...

ALSA-2026:67468 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: EDAC/bluefield: Fix potential integer overflow CVE-2024-53161 kernel: wifi: mac80211: Discard Beacon frames to non-broadcast address CVE-2025-71127 kernel: KVM: nSVM: Always use vmcb01 in...

Security Vulnerabilities fixed in Firefox ESR 140.16 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component Reporter...

Mozilla Firefox ESR < 153.3

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-93 advisory. - Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 a...

Mozilla Firefox ESR < 140.16

The version of Firefox ESR installed on the remote Windows host is prior to 140.16. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-92 advisory. - Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerabilit...

Mozilla Firefox < 156.0

The version of Firefox installed on the remote Windows host is prior to 156.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-90 advisory. - Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3...

PT-2026-91958

Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16...

MiracleLinux 9 : redis-6.2.24-1.el9_8 (AXSA:2026-1829:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1829:03 advisory. redis: Redis: Remote Code Execution via specially crafted RESTORE payload CVE-2026-66373 redis: Redis: Arbitrary code execution via TLS pending-data...

Stable Channel Update for Desktop

The Stable channel has been updated to 153.0.8010.47/.48 for Windows and Mac and 153.0.8010.47 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log Security Fixes and Rewards Note: Access to bug details and links may be kept...

PT-2026-93139

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

Security Vulnerabilities fixed in Firefox ESR 153.3 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-92005: Use-after-free in the Audio/Video: Web Codecs component Reporter...

Security Vulnerabilities fixed in Firefox 156 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-92033: Privilege escalation in Firefox for Android Reporter Steven Julian Impact high...

ROS-20260915-73-0203

The vulnerability of the epfree function in the eventpoll.c component of the Linux kernel’s operating system is related to the dereferencing of a pointer whose expiration time has passed. Exploiting this vulnerability could allow an attacker to trigger a service failure...