Security Vulnerabilities fixed in Firefox ESR 115.44 — Mozilla

Note : We have changed how we publish advisories. We no longer roll all internally identified memory safety vulnerabilities into a single CVE and are now issuing an advisory for every individual bug. CVE-2026-109705: Sandbox escape, site isolation issue due to incorrect boundary conditions,...

Mozilla Firefox security vulnerabilities

Mozilla Firefox has a security vulnerability stemming from a use-after-free issue in the Layout: Positioned component...

Google Chrome resource management error vulnerability

Versions of Google Chrome prior to 156.0.8078.73 contain a resource management error vulnerability. This vulnerability stems from use-after-free issues in Animation, potentially allowing remote attackers to execute arbitrary code within a sandbox via specially crafted HTML pages...

CentOS Linux 8.5 [TuxCare] Security Update: cpp / gcc / gcc-c++ / gcc-gdb-plugin / gcc-gfortran / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1793103045)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1793103045 advisory. - A flaw was found in GCC. When an application calls the eraseif function on a binary heap priority queue in libstdc++, the library...

AlmaLinux 9 : kernel (ALSA-2026:90365)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:90365 advisory. kernel: udp: Deal with race between UDP socket address change and rehash CVE-2024-57974 kernel: fuse: re-lock request before replacing page cache folio...

Linux Distros Unpatched Vulnerability : CVE-2026-99013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two...

ALSA-2026:90913 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component CVE-2026-92035 firefox: thunderbird: Use-after-free in the Graphics: Canvas2D component CVE-2026-100832 firefox:...

TencentOS Server 4: expat (TSSA-2026:1196)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1196 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

SUSE SLED15: cpp7 / cross-nvptx-gcc7 / cross-nvptx-newlib7-devel / gcc7 / etc (SUSE-SU-2026:4913-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4913-1 advisory. - CVE-2026-95619: libstdc++ integer overflow in new operator bsc1282500. - CVE-2026-102010: UAF due to imprope...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146329)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146329 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146266)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146266 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: nvec: fix use-after-free in nvecrxcompleted In nvecrxcompleted, when an incomplete RX...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146335)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146335 advisory. In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix possible use after free In dmareleasechannel, check chan-device-privatecnt after...

Linux Distros Unpatched Vulnerability : CVE-2026-98870

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: remove stale channels from all sessions on teardown ksmbdsessionsderegister removes a connection's channels from other sessions' channel lists only whil...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-146259)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146259 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: do not leave a dangling sk pointer in ieee802154create sockinitdata attaches the...

TencentOS Server 3: firefox (TSSA-2026:1215)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1215 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

PT-2026-127282

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.73 Description A use after free issue exists in ImageCapture, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page. U...

PT-2026-127286

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.73 Description A use after free issue exists in the Animation component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-127289

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.73 Description A use after free issue exists in the Modularization component. This allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially craft...

PT-2026-127298

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.73 Description A use after free issue exists in Turbolev, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HTML page. Use...

PT-2026-127305

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.73 Description A use after free issue exists in the FileSystem component. This flaw allows a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a...