Security Vulnerabilities fixed in Thunderbird 140.16 — Mozilla

A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. A maliciously constructed IMAP line could cause an out-of-bounds buffer read. A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP respon...

PT-2026-92476

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 140.16 Thunderbird versions prior to 153.3 Thunderbird versions prior to 156 Description A malicious or compromised IMAP server can cause a crash in Thunderbird by sending an untagged ' ID' response. This triggers...

CVE-2026-91143

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling...

CVE-2026-77191 All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window milliseconds to seconds between the completion of the authentication phase and the full enforcement of its assigned ACL...

CVE-2026-12763 Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...

CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

rsync: rsync: Authorization bypass via `auth users` directive parsing

An authorization bypass flaw was found in the rsync daemon. The auth users directive parser incorrectly handles group names containing spaces due to comma-only tokenization. This flaw causes deny rules to be silently discarded, allowing an authenticated user to bypass restrictions and gain...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in its HTTP/1.1 wire parser http/src/main/java/org/http4s/blaze/http/parser/, which carries five independent conformance laxities, notably in Content-Length handling relative to RFC 9110 section 8.6 and RFC 9112. ...

CVE-2026-59178

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-73494

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

EUVD-2026-77758

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

CVE-2026-59178 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWO...

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

Summary The dashboard reads its authentication credentials from $ESPHOMEUSERNAME and $ESPHOMEPASSWORD. Earlier versions, and the legacy esphome dashboard, read the bare $USERNAME and $PASSWORD instead. When the env vars were renamed the bare names were dropped with no fallback, so an operator who...

CVE-2026-73494 blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a...

OESA-2026-3774 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: 'Hello friends,', 'CVE-2026-8286: wrong STARTTLS connection reuse LOW', 'CVE-2026-8458: wrong reuse for different services LOW', 'CVE-2026-8924...

CVE-2026-57127

PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAIAPIKEY or PRAISONAIJWTSECRET and the corresponding recipe value are...

CVE-2026-55235 langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

langgraph-api implements the LangGraph API for rapid development and testing. Prior to 0.10.0, langgraph-api permits a run or cron to specify a relative webhook target that is delivered through an in-process loopback transport, and the authentication middleware treats that transport as internal...

CVE-2026-82433

Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...

CVE-2026-57132 PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAICALLAUTH to disabled makes verifytoken accept requests to /api/v1/agents/id/invoke without CALLSERVERTOKEN authentication. Deployments that use the application's advertised opt-out can expose registered agents and their...