CVE-2026-74955 Privilege escalation in the Request Handling component

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

CVE-2026-74955

Privilege escalation in the Request Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

PT-2026-76988

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 153.1 Description Privilege escalation exists in the Request Handling component. Recommendations Update Firefox t...

CVE-2026-13267

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors in handling HTTP requests. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

The vulnerability of the WTF web browsers’ components in Google Chrome and Microsoft Edge, which allows a hacker to trigger a service failure

The vulnerability of the WTF web browsers Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

CVE-2026-15252

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

CVE-2026-6267 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-6267 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-67183

TinyWeb up to version 0.0.8 is affected by a memory-leak DoS caused by allocations in HttpParser::execute (Url objects, HttpHeaders, and HttpHeader instances) that are never freed due to missing destructors and unreachable deletes. Each authenticated-ill-formed? Actually unauthenticated, per-requ...

DEBIAN-CVE-2026-64232

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

CVE-2026-64232 block: recompute nr_integrity_segments in blk_insert_cloned_request

In the Linux kernel, the following vulnerability has been resolved: block: recompute nrintegritysegments in blkinsertclonedrequest blkinsertclonedrequest already recomputes nrphyssegments against the bottom queue, because "the queue settings related to segment counting may differ from the origina...

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload approximately 150 KB that expands to an arbitrarily large size in memory 1...

0xtrails (>=0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, <=0.17.1), 123pancli (1.0.0) +6612 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.1.0, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =1.0.10, =1.0.10, =0.6.6, =0.6.10, =0.6.9, =0.6.15 - @0xdeepak/wallets 0.0.2 and more Source cves: CVE-2026-67315 Source advisory: OSV:GHSA-F4GW-2P7V-4548...

DEBIAN-CVE-2026-53433

fzf is vulnerable to a Denial of Service DoS due to inefficient HTTP body processing in the --listen mode due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity On². A crafted POST request with many small segments can trigger excessive...

CVE-2026-13563 Edimax EW-7478APC POST Request formL2TPSetup stack-based overflow

A vulnerability has been found in Edimax EW-7478APC 1.04. This impacts the function formL2TPSetup of the file /goform/formL2TPSetup of the component POST Request Handler. Such manipulation of the argument L2TPUserName leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2026-53273 tee: optee: prevent use-after-free when the client exits before the supplicant

In the Linux kernel, the following vulnerability has been resolved: tee: optee: prevent use-after-free when the client exits before the supplicant Commit 70b0d6b0a199 "tee: optee: Fix supplicant wait loop" made the client wait as killable so it can be interrupted during shutdown or after a...

PT-2026-52368

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the OP-TEE driver of the Linux kernel. This occurs when a client task terminates while a supplicant is still processing its request. Because the client m...

CVE-2023-54365 Traefik - Denial of Service via HTTP/2 Request Handling

Traefik before 2.10.5 and 3.0.0-beta4 is affected by a denial-of-service vulnerability in HTTP/2 request handling inherited from the Go standard library's HTTP/2 implementation CVE-2023-44487 / CVE-2023-39325, the 'Rapid Reset' technique. A remote attacker can rapidly create and cancel HTTP/2...