Stable Channel Update for Desktop

The Stable channel has been updated to 144.0.7559.132/.133 for Windows/Mac and 144.0.7559.132 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kept...

PT-2026-38940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the Virtual Function VF does not enable the VCN poison interrupt request irq in VCNv2.5. Attempting to release this interrupt during...

CVE-2026-25221

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-15 and earlier, the OAuth 2.0 implementation for GitHub and Google login providers is vulnerable to Login Cross-Site Request Forgery CSRF. The application fails to implement and verify the state parameter during the...

GO-2026-4365 Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea

Gitea may send release notification emails for private repositories to users whose access has been revoked in code.gitea.io/gitea...

GO-2026-4364 Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea

Gitea does not properly validate repository ownership when linking attachments to releases in code.gitea.io/gitea...

CVE-2026-24007

CVE-2026-24007 affects Tuleap (Open Source Software for software development and collaboration). The vulnerability is a missing CSRF protection in the Overview inconsistent items feature, allowing an authenticated attacker to trick victims into repairing inconsistent items (creating artifact link...

CVE-2026-24007 Tuleap is missing CSRF protection in the Overview inconsistent items

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap is missing CSRF protection in the Overview inconsistent items. An attacker could use this vulnerability to trick victims into repairing inconsistent items creating artifact links from the release. This...

CVE-2026-22227 Command Injection Vulnerability on TP-Link Archer BE230 v1.2

A command injection vulnerability may be exploited after the admin's authentication via the configuration backup restoration function of the TP-Link Archer BE230 v1.2. Successful exploitation could allow an attacker to gain full administrative control of the device, resulting in severe compromise...

CVE-2025-55132 affecting package nodejs for versions less than 20.14.0-11

CVE-2025-55132 affecting package nodejs for versions less than 20.14.0-11. A patched version of the package is available...

aider-chat (0.82.3), aird (0.2.0) +7 more potentially affected by CVE-2026-1703 via pip (25.1.1)

pip PYPI version 25.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aider-chat 0.82.3 - aird 0.2.0 - anki-release =25.6.0b2, =0.8.0, =1.0.0, =1.0.0, =0.1.11, =0.1.12 Source cves: CVE-2026-1703 Source advisory:...

Security Bulletin: WebSphere Application Server Liberty is affected by SMTP injection due to Jakarta Mail (CVE-2025-7962)

Summary WebSphere Application Server Liberty is affected by SMTP injection due to Jakarta Mail Vulnerability Details CVEID:CVE-2025-7962 DESCRIPTION: In Jakarta Mail 2.0.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages...

eScan Antivirus Update Servers Compromised to Deliver Multi-Stage Malware

The update infrastructure for eScan antivirus, a security solution developed by Indian cybersecurity company MicroWorld Technologies, has been compromised by unknown attackers to deliver a persistent downloader to enterprise and consumer systems. "Malicious updates were distributed through eScan'...

Linux dmaengine DoS

The vulnerability of the dmaengine kernel component of the operating system is related to memory release errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

libxml2 security vulnerability

Libxml2 is an open-source library from GNOME that is used for parsing XML documents. It is written in C language and can be called in various languages, such as C, C++, and XSH. Libxml2 has a security vulnerability, which stems from improper memory release in interactive shells, potentially leadi...

Qualcomm Chipsets Resource Management Vulnerability

Qualcomm Chipsets are a series of chipset developed by Qualcomm Incorporation. Qualcomm Chipsets have a resource management vulnerability, which stems from improper handling of memory pointers when releasing the memory buffer of the graphics processing unit, potentially leading to memory corrupti...

Qualcomm Chipsets Resource Management Vulnerability

Qualcomm Chipsets are a series of chipset developed by Qualcomm Incorporation. Qualcomm Chipsets have a resource management vulnerability, which arises from multiple threads accessing the memory release API simultaneously, potentially leading to memory corruption...

Qualcomm Chipsets Resource Management Vulnerability

Qualcomm Chipsets are a series of chipset developed by Qualcomm Incorporation. Qualcomm Chipsets have a resource management vulnerability, which stems from the modification of user-space addresses and their transmission to the memfree API. This can lead to the accidental release of kernel memory...

MediaTek Chipsets Security Vulnerabilities

MediaTek Chipsets are a series of chips developed by MediaTek Corporation in China. The MediaTek Chipsets contain security vulnerabilities, which stem from the reuse of objects after they are released by imgsys, potentially leading to an increase in local privileges...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the xmllint interactive shell when repeatedly providing whitespace-only input. An attacker can exhaust system memory and cause process termination by continuously submitting such...

Mozilla Firefox Code Execution Vulnerability (CNVD-2026-11797)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a code execution vulnerability due to a use-after-release in the Layout: Scroll and Overflow component. An attacker can exploit this vulnerability to execute arbitrary code...