RHEL 8 : thunderbird (RHSA-2026:49922)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49922 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

TZInfo Path Traversal DoS

The vulnerability of the TZInfo time zone database is related to deficiencies in path name limitation for accessing the catalog. Exploiting this vulnerability could allow a malicious actor to cause service failures...

RHEL 9 : thunderbird (RHSA-2026:49921)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49921 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

Important: sg3_utils security, bug fix, and enhancement update

The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes: sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export CVE-2026-16313 Bug Fixes and Enhancements: sginq output...

CVE-2026-66310

External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally...

DEBIAN-CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

UBUNTU-CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

GHSA-M2H6-J472-RP4C python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

Summary If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. PoC !/usr/bin/env python3 """Standalone PoC: pyca's...

python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

Summary If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. PoC !/usr/bin/env python3 """Standalone PoC: pyca's...

CVE-2026-69248 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

CVE-2026-69248

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com,...

CVE-2026-18646

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...

EUVD-2026-52442

A vulnerability was detected in Blix Email Blue Mail Calendar App 2.2.305. Impacted is the function FileDirectory.getDataColumn/FileDirectory.getFileFromUri of the component react-native-receive-sharing-intent. The manipulation of the argument displayname results in path traversal. The attack is...

EUVD-2026-52431

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...

CVE-2026-18646

CVE-2026-18646 affects danpros HTMLy up to 3.1.1. The vulnerability is in the file /system/htmly.php of the Author Name Handler component. Exploitation arises from manipulating the Name argument, enabling path traversal and potentially remote execution. The attack vector is network-based, with a ...

CVE-2026-18646 danpros HTMLy Author Name htmly.php path traversal

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...

CVE-2026-18646 danpros HTMLy Author Name htmly.php path traversal

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...

CVE-2026-18646

A weakness has been identified in danpros HTMLy up to 3.1.1. This vulnerability affects unknown code of the file /system/htmly.php of the component Author Name Handler. Executing a manipulation of the argument Name can lead to path traversal. The attack may be launched remotely. The exploit has...