475612 matches found
firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Thunderbird ESR 140.12 and Thunderbird 152. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of...
WordPress FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) plugin <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability
Cross-Site Request Forgery to Sync Rule Status Toggle vulnerability discovered by Deadbee in WordPress Plugin FuseWP versions = 1.1.24.2...
CVE-2026-59942
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...
CVE-2026-59941
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior accept a BMP image and generates a PDF-compatible PNG based only on its declared header dimensions and never bounds width × height before the image is converted through GD. A 58-byte BMP whose header declares e.g. 6000×6000 is...
CVE-2026-59943
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, if a malicious actor can supply unrestricted content for rendering by Dompdf they can utilize the SVG rendering functionality to leak filesystem information when rendering PDF files using image references within a data-URI...
DEBIAN-CVE-2026-59942
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...
CVE-2026-49447
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...
DEBIAN-CVE-2026-56722
Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...
CVE-2026-15325
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests...
CVE-2026-14976
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled...
CVE-2026-14446 IBM WebSphere Application Server is affected by a privilege escalation
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console...
CVE-2026-59942
Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a Denial of Service DoS attack via resource exhaustion. An attacker can crash the PHP process by providing a specially crafted HTML document containing a single image with massive dimensions e.g., 30,000x30,000...
CVE-2026-59942
CVE-2026-59942 affects Dompdf (PHP HTML-to-PDF converter). Multiple connected sources describe that versions 3.15 and earlier are vulnerable to a Denial of Service caused by resource exhaustion when processing an HTML document containing a single, very large image (e.g., 30,000×30,000). The vulne...
CVE-2026-14893
The CVE is applicable to IBM Observability with Instana (Agent). The vulnerable component is the Node.js tracer, package @instana/core version 6.2.1, within IBM Instana Agent builds 1.0.303 through 1.0.320. The root cause is a prototype pollution flaw in the configuration normalization API, enabl...
EUVD-2026-50058
IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...
CVE-2026-49447
Cosmos-Server 0.22.18 reportedly exposes constellation device metadata via GET /cosmos/api/constellation/public-devices when any non-empty Authorization header is provided; the code strips Bearer but does not validate or use the token in the DB query, allowing unauthenticated-like access to devic...
CVE-2026-49447 Cosmos-Server's constellation public-devices endpoint accepts arbitrary bearer tokens
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. In 0.22.18, GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization heade...
CVE-2026-14973 Path Traversal in IBM Desktop App
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination...
CVE-2026-14973
IBM Aspera Desktop App versions 1.0.5–1.0.19 are affected by CVE-2026-14973, a path traversal flaw that can allow files to be written outside the user-selected download destination. The IBM Security Bulletin (CVE-2026-14973) and related records confirm the vulnerable component and version range, ...