firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the SVG component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the SVG component...

firefox: thunderbird: Sandbox escape due to invalid pointer in the Graphics component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to invalid pointer in the Graphics component...

firefox: thunderbird: Use-after-free in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Navigation component...

firefox: Use-after-free in the Audio/Video component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video component...

firefox: thunderbird: Sandbox escape in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the DOM: Core & HTML component...

firefox: thunderbird: Use-after-free in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the DOM: Core & HTML component...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

@digital-realty/grid (1.2.4-IXUAT-11104.552907), @vaadin/hilla-react-crud (>=24.10.0, <=24.10.8) +4 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.10.0, <=24.10.4)

@vaadin/component-base NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

@arcgis/core (>=5.0.0-next.108, <=5.1.0-next.52), @geoscene/charts-components (>=5.0.19, <=5.0.21) +89 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.0.0, <=25.1.11)

@vaadin/component-base NPM version =25.0.0, =5.0.0-next.108, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =5.0.19, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.14.0-snapshot, =1.13.1, =1.13.1, =1.25.0-snapshot.20260612103548 and more Source cves:...

CVE-2026-91860

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base . The flaw occurs because the application fails to filter keys that address the prototype chain when merging user-controlled objects (e.g., parsed JSON) into chart configurations or a c...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

@vaadin/hilla-react-crud (>=25.2.0, <=25.3.0-alpha2), @vaadin/react-components (>=25.2.0, <=25.2.8) +3 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.2.0, <=25.2.8)

@vaadin/component-base NPM version =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@digital-realty/grid (>=1.2.4-IXUAT-11104.553004, <=1.2.4), @digital-realty/ix-app-logic (>=1.2.5, <=2.1.16) +13 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.7.0, <=24.7.12)

@vaadin/component-base NPM version =24.7.0, =1.2.4-IXUAT-11104.553004, =1.2.5, =1.2.28, =1.1.33, =1.0.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0-alpha.1, =24.7.0, =24.7.0, =24.7.0, =24.7.0-rc2, =24.7.0-rc2, =24.7.15 - ui-inventory 1.0.1-IXUAT-10607.520338 - ui-launchpad 1.0.1-IXUAT-10607.520375...

@arcgis/core (>=4.34.0-next.20, <=4.34.0-next.85), @vaadin-component-factory/vcf-date-time-range-picker (1.0.0) +71 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.8.0-alpha1, <=24.9.17)

@vaadin/component-base NPM version =24.8.0-alpha1, =4.34.0-next.20, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.8.0-alpha1, =24.9.0-rc1 and more...

CVE-2026-91860 Prototype Pollution in Vaadin Charts and Component Base via Unfiltered Deep Merge

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

EUVD-2026-89951

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible t...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses perl 0:5.32.1-481.1.el96, GO-2026-6061- go - google.golang.org/grpc/internal/transport :v1.82.0, nodejs - tar:7.5.19, bind 32:9.16.23-40.el98.2, cryptography 46.0.7, libarchive 3.5.3-9.el97 which is vulnerable to CVE-2023-47038,...

org.apache.camel.karaf:camel-plc4x (>=4.7.0, <=4.18.4), org.apache.camel.springboot:camel-plc4x-starter (>=3.20.0, <=4.23.0) +13 more potentially affected by CVE-2026-102508 via org.apache.plc4x:plc4j-driver-opcua (>=0.9.0, <=0.13.1)

org.apache.plc4x:plc4j-driver-opcua MAVEN version =0.9.0, =4.7.0, =3.20.0, =3.20.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.12.0, =0.13.0, =0.9.0, =0.9.0, =0.12.0 - org.connectorio.plc4x.extras.features:org.connectorio.plc4x.extras.feature.decorator 0.12.0 -...