RLSA-2026:80663 Moderate: tftp security update

The Trivial File Transfer Protocol TFTP is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to...

tftp security update

An update is available for tftp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Trivial File Transfer Protocol TFTP is typically used only for booting...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

firefox: thunderbird: Use-after-free in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the JavaScript Engine: JIT component...

PT-2026-111710

Name of the Vulnerable Software and Affected Versions WorkFlow-Engine versions prior to 9.6.12 Description Authenticated users can complete or reassign workflow tasks belonging to other users due to missing authorization. Low-privileged attackers can exploit this by providing a known taskId to th...

Microsoft Windows: CVE-2026-88193: Microsoft Scripting Engine Elevation of Privilege Vulnerability

Heap-based buffer overflow in Microsoft Scripting Engine allows an authorized attacker to elevate privileges locally...

PT-2026-111800

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions 2.4.4 through 2.4.9 prior to October 2026 security releases Adobe Commerce B2B versions 1.3.x through 1.5.x Magento Open Source versions 2.4.6 through 2.4.9 prior to October 2026 security releases Description An imprope...

PT-2026-112014

Name of the Vulnerable Software and Affected Versions Windows Backup Engine affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At the...

PT-2026-111443

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 115.43 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A JIT miscompilation issue exists within the JIT component...

CVE-2026-109715: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109721: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109729: Use After Free

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

PT-2026-111450

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158 Firefox ESR versions prior to 115.43 Firefox ESR versions prior to 153.5 Thunderbird versions prior to 158 Thunderbird versions prior to 153.5 Description A use-after-free issue exists within the JIT Just-In-Time...

CVE-2026-109716: Improper Restriction of Operations within the Bounds of a Memory Buffer

Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

CVE-2026-109722: Always-Incorrect Control Flow Implementation

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...

Security Vulnerabilities fixed in Firefox ESR 115.43 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-109706: Use-after-free in the Storage: IndexedDB component Reporter Mozilla Impact high...

CVE-2026-110118: Authorization Bypass Through User-Controlled Key

WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handle...

CVE-2026-109733: Access of Resource Using Incompatible Type

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5...