CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

UBUNTU-CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

SUSE CVE-2026-63887

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Bound iscsiencodetextoutput appends to rspbuf iscsiencodetextoutput concatenates "key=value\0" records into login-rspbuf, an 8192-byte kzallocMAXKEYVALUEPAIRS buffer allocated in iscsitallocloginsetupbuffer...

SUSE CVE-2026-64024

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...

SUSE CVE-2026-64192

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

EUVD-2026-46228

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13...

CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16391

Information disclosure in Firefox’s Storage: IndexedDB component (CVE-2026-16391) is addressed in Firefox 153 and Firefox ESR 140.13. The CVSSv3.1 vector indicates an unaltered scope, network attack vector, high confidentiality impact with no impact to integrity/availability, and no user interact...

CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16391 Information disclosure in the Storage: IndexedDB component

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

CVE-2026-16391

Information disclosure in the Storage: IndexedDB component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13...

Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs

An Android app that can draw over other windows and write to shared storage can slip instructions to the AI agent driving that phone, in text no human eye will ever see. Two more steps, and the same app is running commands on the PC driving the agent. Researchers demonstrated that chain, plus six...

CVE-2026-64103

A flaw was found in the Linux kernel's ISCI IntelR C600 Series Chipset Storage Control Unit SCSI driver. This vulnerability occurs during device removal, where a timing issue can allow the system to attempt to use memory that has already been released. This 'use-after-free' condition could be...

EUVD-2026-46137

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jquery/uploader/uploadify.php. This manipulation of the argument https:/ucn9h68n9289.feishu.cn/wiki/JJcTwHz7aiKeq6kSItMcoeSUnMc?from=fromcopylink causes unrestricted upload. Remote...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...

MySQL 9.7 -- Multiple vulnerabilities

The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 43 of which apply to the MySQL 9.7 series and to the MySQL Router shipped with these ports. The 9.7 branch is affected by every server issue of the 8.4 branch plus twelve additional ones in code paths that only exi...

PT-2026-61982

Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 In Progress ShareFile Storage Zones Controller versions prior to 6.0.2 Description An authenticated administrative user can exploit a path traversal vulnerability—a flaw...

The vulnerability of the upload component in the /photo_center/php/uploadify.php file of the D-Link DNS-320 network storage software allows a hacker to cause a service failure.

The vulnerability of the /photocenter/php/uploadify.php component in the D-Link DNS-320 network storage software is related to errors in access control when processing the “Malicious Handler” parameter. Exploiting this vulnerability allows an attacker to cause service failures...

CVE-2026-47255

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed...