vulnerabilities handled in Mozilla Firefox

Mozilla has identified vulnerabilities in Firefox, specifically in version 152.0.6. Through a combination of two vulnerabilities, malicious actors can execute malicious code on victims’ systems remotely. For successful exploitation, users must visit a malicious website or a legitimate website wit...

Use After Free

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

MAL-2026-10662 Malicious code in ssweb-wp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdc75de95852418c3d695299d52199b24e52202b2e5595089b3107a73c1e86b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-60382

Name of the Vulnerable Software and Affected Versions websocket-driver versions prior to 0.7.5 Description When used with the permessage-deflate extension, a WebSocket server or client may accept messages exceeding the configured maximum message size. This occurs because the size limit is validat...

PT-2026-60372

Name of the Vulnerable Software and Affected Versions cyberdrop-dl-patched versions prior to 9.14.0 Description When processing Pixeldrain URLs, the software may send an Authorization header containing the user's API key to unverified hosts. This occurs because the application matches URLs to a...

CVE-2026-15622 poco-ai poco-claw Workspace API workspace.py get_workspace_file authorization

A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function getworkspacefile of the file executormanager/app/api/v1/workspace.py of the component Workspace API. Executing a manipulation of the argument userid can lead to authorization bypass. The attack may be launched...

PYSEC-2026-2354 Apache Airflow has an Authorization Bypass Through User-Controlled Key

The Event Log detail endpoint GET /api/v2/eventLogs/eventlogid in Apache Airflow fetched audit-log rows directly by numeric ID after only the generic Audit Log permission check, while the collection endpoint GET /api/v2/eventLogs applied per-Dag scoping. An authenticated UI/API user with audit-lo...

PYSEC-2026-2348 Apache Airflow error reporting may expose full kwargs

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values such as secrets, they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue...

K000162210: Multiple Apache Tomcat vulnerabilities

Security Advisory Description CVE-2026-55957 Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from...

Malicious code in ishowfeet12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60cb6a8169d535b5e52d5fa3cb7a1a16bf4f2d15f87d894a4111da9b74fedae The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in kirkland (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fbd3da78615dc607bb287e809874ccce081e816a5eeb1120421118da70bcba5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-15525

A vulnerability was detected in kLOsk adloop up to 0.9.0. This vulnerability affects the function validateurls of the file src/adloop/ads/write.py. Performing a manipulation of the argument finalurl results in server-side request forgery. The attack may be initiated remotely. The exploit is now...

CVE-2026-15476

A security vulnerability has been detected in QILING Disk Master 6.0.0.0. The impacted element is an unknown function in the library diskbckp.sys of the component Kernel Driver. Such manipulation leads to improper access controls. The attack can only be performed from a local environment. The...

[SECURITY] [DLA 4676-1] wireless-regdb new upstream version

Debian LTS Advisory DLA-4676-1 [email protected] https://www.debian.org/lts/security/ Ben Hutchings July 11, 2026 https://wiki.debian.org/LTS Package : wireless-regdb Version : 2026.05.30-1deb11u1 2026.05.30-1deb12u1 This update includes the changes in wireless-regdb 2026.05.30,...

CVE-2026-15330

A vulnerability was determined in zhayujie CowAgent up to 2.1.1. Impacted is the function buildimagecontent/downloadtodataurl of the file agent/tools/vision/vision.py of the component Vision Tool. Executing a manipulation of the argument image can lead to server-side request forgery. The attack c...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.12.93 security and extras update

Red Hat OpenShift Container Platform release 4.12.93 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a security impact of Low...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:linkify-it is a Links recognition library with FULL unicode support Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the mailto: validator scan-loop on attacker-supplied text. An attacker can cause excessive CPU consumption by...

MAL-2026-6987 Malicious code in @luminarycloudinternal/lcvis-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24 Package @luminarycloudinternal/[email protected] is published to the public npm registry under an internal-looking scope with an artificially high...

CVE-2026-46158 affecting package kernel for versions less than 6.6.143.1-1

CVE-2026-46158 affecting package kernel for versions less than 6.6.143.1-1. An upgraded version of the package is available that resolves this issue...

Security Bulletin: IBM Tivoli Composite Application Manager for Application Diagnostics installed IBM WebSphere Application Server and WebSphere Application Server Liberty which are affected by multiple vulnerabilities

Summary The security issue described in CVE-2026-50645, CVE-2026-9322 and CVE-2026-9171 has been identified in WebSphere Application Server and WebSphere Application Server Liberty included as part of IBM Tivoli Composite Application Manager for Application Diagnostics. Vulnerability Details Refe...