Security Vulnerabilities fixed in Thunderbird 153.1 — Mozilla

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs...

Mozilla Firefox ESR < 140.14

The version of Firefox ESR installed on the remote Windows host is prior to 140.14. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-76 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14...

Mozilla Firefox ESR < 153.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 153.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-77 advisory. - Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 154, Firefox E...

Security Vulnerabilities fixed in Firefox ESR 140.14 — Mozilla

Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. Internally found bugs present in...

Linux Distros Unpatched Vulnerability : CVE-2026-72050

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - octeontx2-af: Free BPID bitmap on setup failure nixsetupbpids allocates bp-bpids with rvuallocbitmap, which uses a plain kcalloc. If any of the following...

PT-2026-77152

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.40.0, CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeofint64 t overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the...

nodejs:24 security update

nodejs 1:24.18.0-6 - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 memory exhaustion via deeply chained brace groups. as well as CVE-2026-14257 fixed in 5.0.8. 1:24.18.0-5 - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address 1:24.18.0-4 - deps: update sqlite to 3.53.4...

Linux Distros Unpatched Vulnerability : CVE-2026-68455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - liveupdate: validate session type before performing operation The sessions ioctls are not applicable to all session types. PRESERVEFD is only applicable to...

Linux Distros Unpatched Vulnerability : CVE-2026-72223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvdimm/btt: Free arena sub-allocations on discoverarenas error path Memory allocated by bttfreelistinit, bttrttinit, and bttmaplocksinit is not freed on some...

Linux Distros Unpatched Vulnerability : CVE-2026-72290

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: pci: Fix GISC refcount leak on AIF enable failure kvms390giscregister registers the guest ISC before pinning the guest interrupt forwarding pages and...

Linux Distros Unpatched Vulnerability : CVE-2026-72137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanu...

Linux Distros Unpatched Vulnerability : CVE-2026-74381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gpu: host1x: Allow entries in BO caches to be freed When a buffer object is pinned via host1xbopin with a cache, the resulting mapping is kept in the cache so i...

Linux Distros Unpatched Vulnerability : CVE-2026-72292

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: s390: Initialize KVMS390GETCMMABITS memory kvms390getcmmabits allocates its output buffer with vmalloc, which does not zero the returned pages: values =...

Linux Distros Unpatched Vulnerability : CVE-2026-72020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: reset full ipvsseq structs in ipvsconnnew Commit 9a05475cebdd ipvs: avoid kmemcachezalloc in ipvsconnnew changed ipvsconnnew to allocate an ipvsconn objec...

Linux Distros Unpatched Vulnerability : CVE-2026-74427

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the...

Linux Distros Unpatched Vulnerability : CVE-2026-72265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: nvidia: fix potential memory leak in nvidiafbprobe In nvidiafbprobe, the memory allocated for modelist in nvidiasetfbinfo is not freed in the subsequent...

Linux Distros Unpatched Vulnerability : CVE-2026-72269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - fbdev: uvesafb: fix potential memory leak in uvesafbprobe Due to an incorrect goto label, memory allocated for modedb and modelist in uvesafbvbeinit is not free...

Linux Distros Unpatched Vulnerability : CVE-2026-72286

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: SEV: Do not allow intra-host migration/mirroring of SNP VMs The intra-host migration/mirroring feature is not fully implemented for SEV-SNP VMs. The proper...

Linux Distros Unpatched Vulnerability : CVE-2026-72377

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - afs: Remove setting of ASRELEASEALWAYS for symlinks and mountpoints Regular AFS files correctly use afsfileaops which have releasefolio set as netfsreleasefolio...

Linux Distros Unpatched Vulnerability : CVE-2026-72456

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: release exe file resources on path failure getcurrentexepath takes both an exefile reference and a path reference before resolving the path name. If...