CVE-2026-2790

Same-origin policy bypass in the Networking: JAR component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

EUVD-2026-8440

Use-after-free in the Graphics: ImageLib component. This vulnerability affects Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8...

EUVD-2026-8508

Use-after-free in the DOM: Window and Location component. This vulnerability affects Firefox 148, Firefox ESR 115.33, and Firefox ESR 140.8...

CVE-2026-2775

Mitigation bypass in the DOM: HTML Parser component. This vulnerability affects Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

CVE-2025-32049 affecting package libsoup for versions less than 3.4.4-12

CVE-2025-32049 affecting package libsoup for versions less than 3.4.4-12. A patched version of the package is available...

CVE-2026-0994 affecting package pytorch for versions less than 2.2.2-12

CVE-2026-0994 affecting package pytorch for versions less than 2.2.2-12. A patched version of the package is available...

CVE-2026-1536 affecting package libsoup for versions less than 3.4.4-12

CVE-2026-1536 affecting package libsoup for versions less than 3.4.4-12. A patched version of the package is available...

PT-2026-21728

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 148 Thunderbird versions prior to 148 Description A use-after-free issue exists in the JavaScript: GC component. This condition can occur when memory is accessed after it has been freed, potentially leading to crashes...

CVE-2026-26989

LibreNMS contains a Stored XSS in the Alert Rules workflow in versions 25.12.0 and earlier, due to vulnerable code in alert_rule_list.inc.php. The underlying issue is that admin users can inject scripts that execute in other users’ browsers when viewing the Alert Rules page. Impact is limited to ...

Aruba ClearPass Policy Manager 6.11.x < 6.11.13 / 6.12.x < 6.12.7 Local Privilege Escalation (CVE-2026-23599)

The version of Aruba ClearPass Policy Manager installed on the remote host is prior to 6.11.13 or 6.12.7. It is, therefore, affected by a local privilege escalation vulnerability as referenced in the HPESBNW05012 advisory. - A local privilege-escalation vulnerability has been discovered in the HP...

PT-2026-21138

Name of the Vulnerable Software and Affected Versions fuelthemes PeakShops versions prior to 1.5.9 Description The software contains a flaw related to improper control of filename handling for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the inclusion...

CVE-2026-25506 affecting package munge for versions less than 0.5.18-1

CVE-2026-25506 affecting package munge for versions less than 0.5.18-1. An upgraded version of the package is available that resolves this issue...

PT-2026-20711

Missing Authorization vulnerability in NooTheme CitiLights noo-citilights allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CitiLights: from n/a through 3.7.2...

CVE-2026-20141

In Splunk Enterprise versions below 10.0.2, 10.0.3, 9.4.8, and 9.3.9, a low-privileged user who does not hold the "admin" Splunk role could access the Splunk Monitoring Console App endpoints due to an improper access control. This could lead to a sensitive information disclosure. The Monitoring...

GHSA-782P-5FR5-7FJ8 OpenClaw Affected by Remote Code Execution via System Prompt Injection in Slack Channel Descriptions

Summary When the Slack integration is enabled, Slack channel metadata topic/description could be incorporated into the model's system prompt. Impact Prompt injection is a documented risk for LLM-driven systems. This issue increased the injection surface by allowing untrusted Slack channel metadat...

CVE-2025-32355

CVE-2025-32355 affects Rocket TRUfusion Enterprise up to version 7.10.4.0, where the built-in reverse proxy can be misconfigured to accept absolute URLs in the HTTP request line. This enables server-side requests to load arbitrary resources via the proxy, constituting a server-side request forger...

CVE-2026-2003 affecting package postgresql for versions less than 14.21-1

CVE-2026-2003 affecting package postgresql for versions less than 14.21-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-69421 affecting package hvloader for versions less than 1.0.1-17

CVE-2025-69421 affecting package hvloader for versions less than 1.0.1-17. A patched version of the package is available...

CVE-2026-24747 affecting package pytorch for versions less than 2.0.0-13

CVE-2026-24747 affecting package pytorch for versions less than 2.0.0-13. A patched version of the package is available...

AZL-77423 CVE-2026-2004 affecting package postgresql for versions less than 16.12-1

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected...