Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Removed obsolete mozilla-nss-certs and recommends p11-kit-nss-trust bsc1269226 Update to Firefox 140.12.0 ESR MFSA 2026-58, bsc1268071: CVE-2026-12289: Privilege escalation in the Graphics: WebRender component. CVE-2026-12290: Memory safe...

edk2 security, bug fix, and enhancement update

An update is available for edk2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

CVE-2026-55878 Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative accepts paths like ../../../etc, a crafted or...

CVE-2026-55878 Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitrary File Write and Read via Crafted Recipe Manifest

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative accepts paths like ../../../etc, a crafted or...

Malicious code in luludawang-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...

CVE-2026-55878: Improper Limitation of a Pathname to a Restricted Directory

Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0, the ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map, and because Path::isRelative accepts paths like ../../../etc, a crafted or...

SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...

PYSEC-2026-1935 SPDK is vulnerable to buffer overflow in the NVMe-oF target component

Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...

WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.7...

MAL-2026-7086 Malicious code in @mts-pay/web-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

Exposure of Sensitive Information in mltable

Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...

PYSEC-2026-1664 Exposure of Sensitive Information in mltable

Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability...

PYSEC-2026-1261 Microsoft Common Data Model SDK Denial of Service Vulnerability

Microsoft Common Data Model SDK Denial of Service Vulnerability...

WordPress Funnel Kit Funnel Builder PRO plugin <= 3.15.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Austin Ginder in WordPress Plugin Funnel Kit Funnel Builder PRO versions = 3.15.0.4...

sui-txblock-deser-poc

@mysten/sui.js TransactionBlock Deserialization PoC Summar...

PT-2026-56256

Name of the Vulnerable Software and Affected Versions FluxInk Color Management Driver versions 1.0.7.2 through 1.0.7.5 Description The Color Management Driver TcnPeripheral64.sys allows a standard user account to achieve local privilege escalation. This is possible through arbitrary physical memo...

MCP Ruby SDK - Ruby SSE Session Poisoning

Summary Vulnerability: Missing Session Ownership Validation in the Ruby MCP SDK's Streamable and SSE HTTP transport implementation. Any attacker with a stolen session ID can execute tools with the victim's session. This is a silent attack - the victim's session is compromised and being used for...

CVE-2026-48267

DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue...

Malicious Package

Overview theta-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-6873 Malicious code in router-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f60a60e68f645bffe7eb5e137979aa6fb6c535c53ee6e13a9fcf01951eb05b55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...