UBUNTU-CVE-2026-84375

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15...

UBUNTU-CVE-2026-84372

Predis is a flexible and feature-complete Redis and Valkey client for...

UBUNTU-CVE-2026-83617

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core...

UBUNTU-CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core...

UBUNTU-CVE-2026-52130

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in...

UBUNTU-CVE-2026-84305

sqlparse is a non-validating SQL parser module for Python. Prior to 0...

UBUNTU-CVE-2026-84130

Unknown description...

UBUNTU-CVE-2026-84135

Unknown description...

UBUNTU-CVE-2026-68763

Uncontrolled Resource Consumption vulnerability in Apache Tomcat via an allocation leak in the HTTP/2 backlog tracking when a stream is reset This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.39 through 9.0.120. The following versions were...

UBUNTU-CVE-2026-68514

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyOpenEXR Python bindings contain a heap out-of-bounds write triggered when reading a crafted deep...

UBUNTU-CVE-2026-79775

rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...

UBUNTU-CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary...

UBUNTU-CVE-2026-54789

modauthopenidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of...

UBUNTU-CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

UBUNTU-CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

UBUNTU-CVE-2026-74962

Site isolation issue in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

UBUNTU-CVE-2026-74935

Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

UBUNTU-CVE-2026-74961

Side-channel in the Web Audio component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

UBUNTU-CVE-2026-74964

Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...

UBUNTU-CVE-2026-74976

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1...