EUVD-2026-24097

Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150...

CVE-2026-6768

Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

UBUNTU-CVE-2026-6756

Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150...

CVE-2026-6756

Mitigation bypass in Firefox for Android. This vulnerability was fixed in Firefox 150...

EUVD-2026-24126

Memory safety bugs present in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This...

CVE-2026-6774 Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150 and Thunderbird 150...

CVE-2026-6771 Mitigation bypass in the DOM: Security component

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

CVE-2026-6747 Use-after-free in the WebRTC component

Use-after-free in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10...

PT-2026-33968

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Description Information disclosure occurs in the IP Protection component. Recommendations Update Firefox to version 150. Update Thunderbird to version 150...

PT-2026-33942

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 150 Description A mitigation bypass exists in the software. Recommendations Update to version 150...

PT-2026-33961

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Thunderbird versions prior to 150 Description Incorrect boundary conditions exist in the WebRTC component, which is a framework that enables real-time communication voice, video, and data within web browsers...

PT-2026-34055

mailcow: dockerized is an open source groupware/email suite based on docker. In versions prior to 2026-03b, no administrator verification takes place when deleting Forwarding Hosts with /api/v1/delete/fwdhost. Any authenticated user can call this API. Checks are only applied for edit/add actions,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011339)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011339 advisory. In the Linux kernel, the following vulnerability has been resolved: HSI: omapssi: Fix refcount leak in ssiprobe When returning or breaking early from a...

PT-2026-34037

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Signing ID as an Apple platform binary. This bug allows a malicious software to impersonate an apple...

PT-2026-33951

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 150 Firefox ESR versions prior to 140.10 Thunderbird versions prior to 150 Thunderbird versions prior to 140.10 Description Information disclosure occurs in the Form Autofill component. Recommendations Update to versi...

Security update for jetty-minimal

This update for jetty-minimal fixes the following issues: CVE-2025-11143: Fixed different parsing of invalid URIs bsc1259242. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the comma...

CVE-2026-40317

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 JumpToUser accepts an arbitrary entry point address from user-space registers without validation, allowing any Ring 3 user-mode process to jump to kernel addresses and execute...

CVE-2026-40477 Improper restriction of the scope of accessible objects in Thymeleaf expressions

Thymeleaf is a server-side Java template engine for web and standalone environments. Versions 3.1.3.RELEASE and prior contain a security bypass vulnerability in the expression execution mechanisms. Although the library provides mechanisms to prevent expression injection, it fails to properly...

CVE-2026-40352

CVE-2026-40352 : FastGPT (pre-4.14.9.5) is vulnerable to NoSQL injection on the password-change endpoint. An authenticated, low-privileged attacker can bypass the old-password check by injecting MongoDB operators, enabling password changes for their account (and potentially others with ID manipul...

EUVD-2026-23482

Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when deserializing a slice packet, the xdrdatum function does not validate that a cstring length conforms to the slice descriptor bounds, allowing a cstring longer than the allocated...