PT-2026-102604

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists in the DOM: UI Events & Focus Handling component. A use-after-free is a memory corruption flaw that...

PT-2026-102543

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 153.4 Firefox ESR versions prior to 140.17 Thunderbird versions prior to 157 Description A use-after-free issue exists in the JavaScript: WebAssembly component. Use-after-free is a...

PT-2026-102546

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 157 Firefox ESR versions prior to 140.17 Firefox ESR versions prior to 153.4 Thunderbird versions prior to 157 Description A use-after-free issue exists within the DOM: Core & HTML component. A use-after-free occurs...

ruby:3.3 security update

ruby 3.3.12-9 - Fix memory exhaustion via unknown DNS resource types in resolv. CVE-2026-80212 Resolves: RHEL-252039 3.3.12-8 - Upgrade to Ruby 3.3.12. Resolves: RHEL-171335 Resolves: RHEL-193665 3.3.10-7 - Fix DoS via crafted IMAP responses in net-imap. CVE-2026-42245 Resolves: RHEL-181693 - Fix...

ruby:4.0 security update

ruby 4.0.6-35 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion CVE-2026-80212 Resolves: RHEL-252035 4.0.6-34 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211301 Resolves: RHEL-193663 4.0.3-33 - Fix Net::IMAP ResponseReader quadratic...

Debian dsa-6530 : libpcre2-16-0 - security update

The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6530 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6530-1 [email protected] https://www.debian.org/security/...

CVE-2026-102566: Out-of-bounds Write

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95298): chromium -- security fixes

Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

CVE-2026-84421: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95306): chromium -- security fixes

Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95335): chromium -- security fixes

Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

FreeBSD: VID-bd24bc14-b9a9-11f1-bf98-a8a1599412c6 (CVE-2026-95365): chromium -- security fixes

Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2024-31027

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

PT-2026-102876

🚨 CVE-2026-76732 A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met...

PT-2026-102945

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description An issue exists in the SAML single sign-on session handling samld where untrusted data is deserialized. An attacker who has already obtained the ability to write files on the...

CVE-2026-101169: Deserialization of Untrusted Data

In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafted JSON content for the object. Insecure deserialization of this content allows the user to execute arbitrary code in the Octopus Server process...

CVE-2026-92368: Heap-based Buffer Overflow

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...

CVE-2026-76721: Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-102321: Access of Resource Using Incompatible Type

Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91191: Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...