GHSA-PWW6-475J-F225 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-FCRV-8VH3-4PG3 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-QX55-562J-V29W vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-W7PF-4G5Q-P5J6 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-GMHX-JJQV-69V4 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-94P9-R92M-453H vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-9JQJ-4CR8-RR2F vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-H3RC-FW55-GV3F vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-JXFH-R792-52QR vulnerabilities

Vulnerabilities for packages: chromium...

Oracle Linux 7 : firefox (ELSA-2026-24983)

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-24983 advisory. - Update to 140.10.2 ESR Orabug: 39534787CVE-2026-8090CVE-2026-8092 CVE-2026-8094 - Update to 140.10.1 ESR Orabug: 39481850CVE-2026-7320CVE-2026-7321...

CGA-82RR-7M9X-PXCM

Bulletin has no description...

K000161993: Golang vulnerability CVE-2025-47912

Security Advisory Description The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: "http://::1/". IP...

@bedrock/express (8.6.5), @cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6) +1 more potentially affected by CVE-2026-6556 via @fastify/express (>=4.0.1, <=4.0.5)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-6556 Source advisory: SNYK:JS-FASTIFYEXPRESS-17744444...

CGA-68W2-X2Q2-WFHR

Bulletin has no description...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59194 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59194 Source advisory: SNYK:JS-PNPM-17661047...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +94 more potentially affected by CVE-2026-48801 via linkify-it (5.0.0)

linkify-it NPM version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on linkify-it and may be impacted: - @activeboxes/piece-gmail 0.8.1 - @activeboxes/piece-imap 0.2.10 - @activepieces/piece-gmail =0.6.0, =0.2.6, =0.0.1, =1.0.0, =1.0.6 -...

RHEL 9 : perl-IO-Compress (RHSA-2026:30085)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:30085 advisory. This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries. IO-Compress...

GO-2026-5726 Mattermost doesn't enforce slash command trigger-word uniqueness during command updates in github.com/mattermost/mattermost-server

Mattermost doesn't enforce slash command trigger-word uniqueness during command updates in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-5671 Mattermost doesn't validate the Host header when constructing response URLs for custom slash command in github.com/mattermost/mattermost-server

Mattermost doesn't validate the Host header when constructing response URLs for custom slash command in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is...

GO-2026-5256 Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server

Mattermost does not verify remote cluster channel access when processing shared channel membership removals in github.com/mattermost/mattermost-server. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If...