firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...

PT-2026-46811

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 149.0.7827.53 Description Side-channel information leakage in PerformanceAPIs allows a remote attacker to leak cross-origin data through the use of a crafted HTML page. Recommendations Update to version...

CVE-2025-70365

A stored cross-site scripting XSS vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

exploit-CVE-2026-23744 MCPJam Inspector is a local-first devel...

EUVD-2026-21216

When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the...

GHSA-M758-WJHJ-P3JQ Wasmtime has a possible panic when lifting `flags` component value

Impact Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits should be ignored but Wasmtime will panic when this value is lifted. This pani...

CVE-2026-34943 Wasmtime panics when lifting `flags` component value

Wasmtime is a runtime for WebAssembly. Prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, Wasmtime contains a possible panic which can happen when a flags-typed component model value is lifted with the Val type. If bits are set outside of the set of flags the component model specifies that these bits...

EUVD-2025-209388

A stored cross-site scripting XSS vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected...

CVE-2025-70365

A stored cross-site scripting XSS vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected...

CVE-2025-70365

A stored cross-site scripting XSS vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected...

CVE-2025-70365

A stored cross-site scripting (XSS) vulnerability exists in Conecteo Kiamo (versions prior to 8.4 ) due to improper output encoding of user-supplied input within the administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code, which then executes in the br...

PT-2026-31638

A stored cross-site scripting XSS vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected...

CVE-2025-70365: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in Kiamo before 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected...

CVE-2026-39892

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers e.g. Hash.update, this could lead to buffer overflows. This vulnerability is fixed in...

EUVD-2026-20640

Cryptography vulnerable to buffer overflow if non-contiguous buffers were passed to APIs...

[SECURITY] Fedora 43 Update: corosync-3.1.10-2.fc43

This package contains the Corosync Cluster Engine Executive, several default APIs and libraries, default configuration files, and an init script...

EUVD-2026-19336

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory...

SUSE-SU-2026:1187-1 Security update for the Linux Kernel RT (Live Patch 9 for SUSE Linux Enterprise 15 SP7)

This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.7.31 fixes various security issues The following security issues were fixed: - CVE-2026-23074: net/sched: Enforce that teql can only be used as root qdisc bsc1258051. - CVE-2026-23111: netfilter: nftables: fix inverted genmask check in...

Incomplete Fix for CVE-2026-0848: 5 Stanford Interface Classes Still Vulnerable to Untrusted JAR Code Execution

Description CVE-2026-0848 fixed untrusted JAR code execution in StanfordSegmenter by adding SHA256 verification in PR 3477. However, the fix was ONLY applied to nltk/tokenize/stanfordsegmenter.py. Five other Stanford interface classes have the identical vulnerability — they accept user-controllab...

Code Screenshot Generator MCP 操作系统命令注入漏洞

Code Screenshot Generator MCP is a code screenshot generation tool developed by Moussaab Badla. Versions of Code Screenshot Generator MCP prior to 0.1.0 contained a vulnerability related to operating system command injection, which stemmed from HTTP interfaces allowing for OS command injections...