KLA91250 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security vulnerability in the Remote Settings Client...

PT-2026-84523

Name of the Vulnerable Software and Affected Versions js-yaml versions 3.0.0 through 3.15.1 js-yaml versions prior to 4.3.2 Description An issue exists where maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js fails to count empty mapping sources when processing the merge key . This allo...

CVE-2026-52111

An issue in fast-note-sync-service =2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes authTokenKey...

CVE-2026-52022

Kamailio v.6.1.1 and before contains a vulnerability in its IMS P-CSCF registration handling components that allows a remote, unauthenticated attacker to trigger a denial of service over the network (CVSS 3.1: 7.5 HIGH ). The vulnerability requires no user interaction and results in high availabi...

CVE-2026-52132

llama.cpp through commit 97f06e9 is vulnerable to a remote denial of service when started with the --reranking flag. A negative top_n value in a POST request to the /rerank endpoint triggers a std::bad_alloc exception, resulting in an HTTP 500 and service disruption. The vulnerability requires no...

Linux Distros Unpatched Vulnerability : CVE-2026-83613

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

Linux Distros Unpatched Vulnerability : CVE-2026-84268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the SFTP backend in gvfs. When mounting a share and reading a file, a malicious SFTP server can cause readreply to process a length that...

PT-2026-84462

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that causes the get outline function in pypdf/ doc common.py to consume excessive memory and long runtimes. This occurs when retrieving document outlines that contain ...

PT-2026-84463

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.16.1 Description An attacker can craft a PDF file that leads to excessive memory consumption and long runtimes. This occurs when extracting text from a page containing numerous reused form XObjects, where a form invok...

PT-2026-84073

A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directory restrictions and access files outside the...

EUVD-2026-69409

Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamfwriter.c component...

PT-2026-84397

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Missing authorization in the custom inference service allows a user with only inference execution privileges to redirect outbound inference traffic to an arbitrary destination. This...

EUVD-2026-69392

An issue in cleverangeauth v.0.1.10 allows a remote attacker to cause a denial of service via the accountverification function and the accounts/models.py component...

CVE-2026-52023

Kamailio (SIP router) versions v.6.1.1 and earlier contain a Denial of Service vulnerability in the ims_registrar_pcscf module. The root cause lies in the pcscf_save_pending/save_pending code path and the security-agreement parsing function parse_sec_agree() in sec_agree.c, which a remote attacke...

Linux Distros Unpatched Vulnerability : CVE-2026-84269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length that exceeds the size...

AlmaLinux 9 : nodejs:24 (ALSA-2026:61386)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61386 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

Linux Distros Unpatched Vulnerability : CVE-2026-84270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the MTP backend in gvfs. When reading a file from a mounted MTP device, doread in gvfsbackendmtp.c trusts the data length returned by the...

Linux Distros Unpatched Vulnerability : CVE-2026-83614

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

CVE-2026-52295

Buffer Overflow vulnerability in Ffmpeg v.7.0 and after allows an attacker to cause a denial of service via the libavformat/iamfwriter.c component...

Linux Distros Unpatched Vulnerability : CVE-2026-18743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a...