CVE-2026-71259

ESPHome (up to 2026.7.0-dev) is affected by an operator-precedence bug in the cv.url() validator within esphome/config_validation.py. The condition if parsed.scheme and parsed.netloc or parsed.scheme == "file" incorrectly permits file:// URIs to bypass validation, affecting the url: field of the ...

EUVD-2026-42356

Fiber is an Express inspired web framework written in Go. Prior to 3.4.0, the helmet middleware in middleware/helmet/helmet.go never sets the Strict-Transport-Security response header even when HSTSMaxAge is configured because it checks c.Protocol for https instead of c.Scheme. This issue is fixe...

Mozilla Thunderbird < 91.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-41 advisory. - Mozilla developers Tyson Smith, Christian Holler, and Gabriele Svelto reported memory safety bugs present...