CVE-2026-16350

Incorrect boundary conditions in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Improper Authorization

Snipe-IT is vulnerable to Improper Authorization. The vulnerability is due to improper enforcement of company boundary validation when creating locations, where an invalid parent-child company relationship is detected but not blocked, allowing authenticated users to create child locations under...

The vulnerability of the pl011_dma_rx_callback() function in the drivers/tty/serial/amba-pl011.c file of the console TTY driver in the Linux kernel’s serial port allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the pl011dmarxcallback function in the drivers/tty/serial/amba-pl011.c file of the console TTY driver in the Linux kernel’s serial port module is related to the occurrence of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an...

PT-2026-61901

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description An integer overflow occurs in the Libraries component of NSS due to incorrect boundary conditions. An integer overflow is a condition where an arithmetic operation...

PT-2026-61862

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description Incorrect boundary conditions exist within the Audio/Vide...

PT-2026-61880

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description Incorrect boundary conditions exist within the JavaScript: WebAssembly component...

PT-2026-61905

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description Incorrect boundary conditions exist within the Graphics: WebGPU component. WebGPU is a modern API that allows web applications to access the GPU for hardware-accelerat...

PT-2026-61876

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description Incorrect boundary conditions exist within the Audio/Video: Playback component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61869

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description The Graphics component contains incorrect boundary...

PT-2026-61871

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description Incorrect boundary conditions exist within the Audio/Vide...

ROS-20260721-73-0008

The vulnerability of WebRTC technology in Google Chrome and Microsoft Edge relates to memory boundary violation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

Mozilla Firefox < 153.0

The version of Firefox installed on the remote Windows host is prior to 153.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-68 advisory. - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory...

Mozilla Firefox ESR < 140.13

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.13. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-70 advisory. - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of...

The vulnerability of the `nvme_dbbuf_set()` function in the driver/nvme/host/pci.c module of the Linux NVME driver allows a attacker to escalate their privileges or execute arbitrary code.

The vulnerability of the nvmedbbufset function in the drivers/nvme/host/pci.c file of the NVME kernel driver in Linux is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability can allow an attacker to increase their privileges or execute arbitrary code...

BIT-NGINX-AGENT-2026-60062 NGINX Agent Vulnerability

The NGINX Agent configdirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The configdirs directive required for this issue can also be configured through NGINX Instance Manager. A successful exploit may allow a...

oras-go: oras-go: File store write outside working directory via symlink traversal

A flaw was found in oras-go. The file content store, intended to confine writes to a specified working directory, does not properly account for symbolic link symlink traversal. A remote attacker, by providing a specially crafted blob title, could exploit this vulnerability to create files outside...

CVE-2026-63838

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA System on Chip ASoC Renesas Sound rsnd component. An incorrect boundary check during the population of the componentdais array can lead to an out-of-bounds memory access. This vulnerability occurs because a loop relies ...

CVE-2026-35217

CVE-2026-35217 affects NanoMQ (MQTT v5) where a SUBSCRIBE packet can be processed even when the final 1-byte Subscription Options field is missing. A specific packet-length construction reveals two manifestations of a single parsing defect: (1) the broker may accept the malformed subscription and...

CVE-2026-58481

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, AgentRuntime allowed reading/listing files outside the configured sandbox basePath due to path containment checks that used raw string prefix tests. A base like /tmp/network-ai-sandbox could be confused with a s...

Amazon Linux 2023 : clamav1.4, clamav1.4-data, clamav1.4-devel (ALAS2023-2026-1956)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1956 advisory. A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory...