Mozilla Firefox ESR < 115.39

The version of Firefox ESR installed on the remote Windows host is prior to 115.39. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-75 advisory. - Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some ...

ANT-2026-PQ3CNCCK · firecracker-microvm/firecracker · Memory Safety / Out-of-Bounds Read+Write (unsafe Rust)

oob-read high CVE-2026-5747 GHSA-776c-mpj7-jm3r Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-PQ3CNCCK: Virtio-PCI queue size writable after activation enables host OOB I...

vcheck v1.6.3

vcheck Audit a remote Linux host over SSH for the Copy Fail and Dirty Frag kernel-module vulnerabilities and, optionally, apply mitigations: CVE| Name| Affected modules ---|---|--- CVE-2026-31431| Copy Fail| algifaead CVE-2026-43284| Dirty Frag IPsec| esp4, esp6, ipcomp4, ipcomp6, xfrmuser...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

CVE-2026-47698

In vm2 versions ≤3.11.5, sandbox code exploits stacked indirection via Function.prototype.call to bypass prototype-chain protections in lib/bridge.js and lib/setup-sandbox.js, severing host intrinsic chains and reaching e.constructor.constructor for arbitrary host command execution. A published P...

CVE-2026-47698 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and...

RLSA-2026:55439 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

ANT-2026-N6TD9MF6 · runc · Symlink-following

symlink-following medium CVE-2026-41579 GHSA-xjvp-4fhw-gc47 Severity Claude high · Security research firm high · Maintainer medium Discovered by an unreleased Anthropic model REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics...

GHSA-CFCW-XP6X-25GJ vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

Summary VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. Details The fix for https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg is insufficient an...

vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

Summary vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike The bufferAllocLimit option introduced in 3.11.0 GHSA-6785-pvv7-mvg7 caps host-side Buffer allocations driven by sandbox code, the way embedders opt into timeout. The cap wraps Buffer.alloc, Buffer.allocUnsafe,...

DEBIAN-CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666 websocket-driver: Denial of service via malformed Host header

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666 websocket-driver: Denial of service via malformed Host header

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666 websocket-driver: Denial of service via malformed Host header

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-61666

CVE-2026-61666 affects the Ruby gem websocket-driver (a WebSocket protocol handler with pluggable I/O). In versions prior to 0.8.2 , WebSocket::Driver.server() passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError. A remote client can e...

CVE-2026-73851

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...