PT-2026-73214

Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens...

CVE-2026-75531: Improper Neutralization of Input During Web Page Generation

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

PT-2026-78278

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System WordPress plugin versions prior to 3.2.37 Description The plugin fails to properly sanitize uploaded SVG files. This allows unauthenticated attackers to upload a file that bypasses the...

PT-2026-73385

Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-sid...

PT-2026-76681

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Discourse versions prior to 2026.5.2 Discourse versions prior to 2026.6.1 Discourse versions prior to 2026.7.0 Description An unauthenticated attacker can inject arbitrary HTML into a page by sending a...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101290)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101290 advisory. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Tenab...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100922)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100922 advisory. Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbi...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101100)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101100 advisory. Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100896)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100896 advisory. A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level document's...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101293)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101293 advisory. Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird...

PT-2026-76828

Name of the Vulnerable Software and Affected Versions Pandora affected versions not specified Description Stored cross-site scripting XSS occurs during the rendering of URL observables. A URL associated with an analyzed file is inserted directly into the inline JavaScript onclick handler of the...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101145)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101145 advisory. Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100889)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100889 advisory. Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101283)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101283 advisory. Incorrect boundary conditions in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101119)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101119 advisory. Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: firefox (UTSA-2026-101487)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101487 advisory. Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Tenable ha...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101316)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101316 advisory. Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 147, Firefox ESR 140.7, Thunderbird 147, and Thunderbird 140.7. Tenable ha...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100930)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100930 advisory. JIT miscompilation, use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8,...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-100901)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100901 advisory. JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: thunderbird (UTSA-2026-101374)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-101374 advisory. Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8. Tenab...