CVE-2026-16387: Exposure of Sensitive Information to an Unauthorized Actor

Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

PT-2026-61870

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 115.38 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird version prior to 140.13 Description A site isolation issue exists within the Graphics:...

PT-2026-61910

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A site isolation issue exists within the Graphics component. Site isolation is a security mechanism that ensures web pages from different sites are processed in separa...

CVE-2026-16375: Origin Validation Error

Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

PT-2026-61937

Name of the Vulnerable Software and Affected Versions Microsoft Azure API Management versions prior to 2025-10-17 Description When self-service signup using username and password Basic Authentication is enabled in one tenant, an attacker can reuse the registration flow to target another tenant by...

Plane contains multi-tenant authorization bypass vulnerability

Overview The project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces. Description Plane is an open-source...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2026-63080: Improper Neutralization of Special Elements used in an SQL Command

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

PT-2026-61911

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A site isolation issue exists within the DOM Navigation component. Site isolation is a security mechanism that ensures web pages from different sites are processed in...

PT-2026-61899

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A site isolation issue exists within the Networking component. Recommendations Update Firefox...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

Linux Distros Unpatched Vulnerability : CVE-2026-15130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Navigation in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass site isolation via a crafted HTML pag...

CVE-2026-16399: Origin Validation Error

Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

PT-2026-62114

Aptabase through commit 5a89368 contains a SQL injection vulnerability in the ClickHouse query backend that allows authenticated attackers to read event data across all tenants by injecting unsanitized filter parameters into Liquid SQL templates. Attackers can supply malicious values through...

CVE-2026-47399: Improper Access Control

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

ROS-20260721-73-0023

The vulnerability of the Site Isolation function in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms through a specially created HTML page...

CVE-2026-16398: Exposure of Sensitive Information to an Unauthorized Actor

Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-16358: Origin Validation Error

Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Mozilla Firefox < 153.0

The version of Firefox installed on the remote Windows host is prior to 153.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-68 advisory. - Memory safety bugs present in Firefox ESR 140.12 and Firefox 152. Some of these bugs showed evidence of memory...