Mozilla Firefox has an unknown vulnerability (CNVD-2026-23640)

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. There is a security vulnerability in Mozilla Firefox, which stems from a sandbox escape in the Profile Backup component. Currently, no detailed details about this vulnerability are available...

CGA-3J9V-8998-QGVM

Bulletin has no description...

@karakeep/mcp (>=0.23.3, <=0.31.0) potentially affected by unknown CVE via @karakeep/sdk (>=0.23.2, <=0.31.0)

@karakeep/sdk NPM version =0.23.2, =0.23.3, =0.31.0 Source cves: unknown CVE Source advisory: OSV:GHSA-7RX4-C5VX-G8W3...

CGA-35F8-RXF9-MRV8

Bulletin has no description...

CGA-5PF9-JJ56-M9RG

Bulletin has no description...

CGA-85R4-MPV8-CWH3

Bulletin has no description...

CGA-37XV-V5QR-X6JG

Bulletin has no description...

CGA-4QMF-4F4X-3JX4

Bulletin has no description...

CVE-2026-33846

A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in mergehandshakepacket where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the messagelength field remains...

xhci (>=0.2.6, <=0.9.2) potentially affected by unknown CVE via accessor (>=0.2.0, <=0.3.3)

accessor CARGO version =0.2.0, =0.2.6, =0.9.2 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0127...

CGA-5PHG-M3M3-7MH9

Bulletin has no description...

CVE-2026-42013

A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name SAN could cause the validation process to incorrectly fall back to checking the Common Name CN field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to...

CGA-8XRQ-8937-Q78C

Bulletin has no description...

CGA-2FRM-J4VC-67Q5

Bulletin has no description...

CVE-2026-6594 brikcss merge prototype pollution

A vulnerability was determined in brikcss merge up to 1.3.0. This affects an unknown part. Executing a manipulation of the argument proto/constructor.prototype/prototype can lead to improperly controlled modification of object prototype attributes. The attack may be performed from remote. The...

CVE-2026-33557

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...

CGA-62J8-JP4X-5H9R

Bulletin has no description...

CGA-33P5-XCG8-MQJQ

Bulletin has no description...

CVE-2026-6308

Out of bounds read in Media in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-6302

Use after free in Video in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...