firefox: thunderbird: Information disclosure in the Framework component in DevTools

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools...

CVE-2026-72778

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

firefox: thunderbird: Information disclosure in the Framework component in DevTools

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Framework component in DevTools...

EUVD-2026-56102

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CVE-2026-72778 Craft CMS 5.0.0-RC1 before 5.10.6 Authenticated RCE via condition.config

Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in the control panel element-search condition handling. Craft cleanses the outer request-controlled condition array via Component::cleanseConfig, but...

CLSA-2026-1786443515 TuxCare security update for laravel/framework (1 CVE)

TuxCare rebuilt laravel/framework to address 1 CVE. Fixed in 6.20.45-p2+tuxcare...

Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection

Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service, and the second was published on Securelist the following month,...

media: pwc: Return queued buffers on start_streaming() failure

...

CVE-2026-8158

The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected...

CVE-2026-6181

The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-5303

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-6505

The CVE-2026-6505 entry concerns the Axis ACAP framework and a Time-of-Check to Time-of-Use (TOCTOU) race condition that could enable privilege escalation. Exploitation requires the Axis device to be configured to allow unsigned ACAP installations and for a user to be convinced to install a malic...

CVE-2026-6505

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-5303

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

EUVD-2026-55964

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-5303

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-5303

The ACAP framework contains a Time-of-Check to Time-of-Use TOCTOU race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces...

CVE-2026-8158

The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected...