PT-2026-76940

Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.8.1 Description An issue exists in the GraalVM JavaScript sandbox allowlist enforcement due to the use of unescaped regular expressions when validating package names. Users with trigger creation privileges can...

PT-2026-76963

Name of the Vulnerable Software and Affected Versions Zabbix server or proxy affected versions not specified Description An authenticated administrator can cause a denial of service by creating specifically crafted JavaScript scripts within preprocessing or script items, which results in the cras...

PT-2026-77151

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link synta...

CVE-2026-52609

A reflected cross-site scripting (XSS) vulnerability exists in reportico-web versions

PT-2026-76969

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to 153.1 Description A use-after-free issu...

KLA91229 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Security vulnerability in t...

PT-2026-76971

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description A mitigation bypass exists within the JavaScript: GC Garbage Collector component. The Garbage...

CVE-2026-74976: Access of Resource Using Incompatible Type

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

CVE-2026-75107: Improper Neutralization of Input During Web Page Generation

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...

PT-2026-77169

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...

CVE-2026-74938: Protection Mechanism Failure

Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74937: Use After Free

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-52606

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

PT-2026-76948

Name of the Vulnerable Software and Affected Versions ArcadeDB server versions prior to 26.8.1 Description The server fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with the awaitResponse parameter set to false, it executes...

CVE-2026-23938: Uncaught Exception

An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service...

CVE-2026-75840: Comparison Using Wrong Factors

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attackers with trigger creation privileges can use Java.type to access java.util.zip.ZipFile or...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

EUVD-2026-61095

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

OPENSUSE-SU-2026:11535-1 bun-1.4.0~git20260808.52bf09cb-2.1 on GA media

These are all security issues fixed in the bun-1.4.0git20260808.52bf09cb-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-75851: Improper Privilege Management

ArcadeDB server com.arcadedb:arcadedb-server in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user,...