thunderbird security update

140.13.0-1.0.1 - Fix prefs for new nss Orabug: 37079820 - Add Oracle prefs file 140.13.0 - Add OpenELA debranding 140.13.0-1 - Update to 140.13.0 ESR...

Important: java-1.8.0-openjdk

Issue Overview: Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit...

Security Updates for Microsoft Windows Admin Center (July 2026)

The Microsoft Windows Admin Center installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. CVE-2026-56169 - Improper...

Important: kernel6.12

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6output CVE-2025-40158 In the Linux kernel, the following vulnerability has been resolved: gpio: Fix resource leaks on errors in gpiochipadddatawithkey CVE-2026-31732 In the Linux kernel, the...

Important: java-1.8.0-amazon-corretto

Issue Overview: Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit...

CVE-2026-66326

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66325

Server-side request forgery ssrf in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66322

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66317

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

CVE-2026-65804

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66316

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66314

Time-of-check time-of-use toctou race condition in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-66315

Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66312

Buffer over-read in Microsoft Edge Chromium-based allows an authorized attacker to execute code over a network...

CVE-2026-66321

Access of resource using incompatible type 'type confusion' in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-66318

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-67974

A parser boundary flaw in the Software Bus Network SBN application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service DoS via sending a crafted packet...

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through improper handling of IPv4 addresses with leading zeros in the Address4. An attacker can bypass network...

CVE-2026-69198 ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. Th...

CVE-2026-69192

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inetaton, and getaddrinfo all decode a leading zero as octal. The library...