477356 matches found
EUVD-2026-121215
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their beans, exposing or modifying other...
EUVD-2026-121214
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside the passivation directory. Users are...
EUVD-2026-121213
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommended to upgrade to version 10.3.0 or...
EUVD-2026-121149
Docker Desktop before version 4.94.0 could write the signed-in user's Docker Hub access token a JWT in cleartext to application logs and diagnostics bundles. IPC payloads that were bare JSON strings or arrays were not redacted before logging, and a Docker Desktop component logged the token when i...
EUVD-2026-121148
In Eclipse Kura versions 5.0.0 through 5.6.2, the Wire Graph update functionality of the Kura Web UI, and the Wire Service REST API v1 available since 5.1.0, org.eclipse.kura.rest.wire.provider, determine whether a configuration update targets a Wire Component, Driver or Asset from the factory...
EUVD-2026-121147
A flaw was found in Podman. An attacker can trigger a Denial of Service DoS by supplying a container image containing crafted metadata labels. Podman's auto-update mechanism improperly trusts these image labels to determine which system services to restart. If a user runs the malicious container...
EUVD-2026-121146
Eclipse Kura downloads deployment packages DPs from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTPS server, or an attacker able to tamper with a plain-HTTP download, can stream an arbitrarily large or endless response. Kura writes the response ...
EUVD-2026-121145
A flaw was found in flightctl. A TLS handshake is performed synchronously in the HTTP server’s connection-context callback without a deadline. A network-reachable unauthenticated client can stall the handshake and prevent the affected listener from accepting new connections...
EUVD-2026-120945
Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45...
EUVD-2026-120944
Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120942
Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120943
Other issue in the SVG component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120940
Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120941
Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120939
Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120938
Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120937
Other issue in the Media component in Firefox for Android. This vulnerability was fixed in Firefox 160...
EUVD-2026-120935
Mitigation bypass in the SVG component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120936
Spoofing issue in the Address Bar component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120934
Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120933
Sandbox escape in the Agent component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120931
Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120932
Sandbox escape in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120930
Clickjacking issue in the Autofill component in Firefox for Android. This vulnerability was fixed in Firefox 160...
EUVD-2026-120929
Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120928
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120926
Use-after-free in the Layout: Positioned component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120927
Sandbox escape due to use-after-free in the DOM: Service Workers component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120924
Use-after-free in the DOM: Editor component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120925
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120923
Incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 160...
EUVD-2026-120921
Incorrect boundary conditions, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120922
Privilege escalation in the Nimbus Desktop Client component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120920
Invalid pointer in the DOM: Streams component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120919
Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120918
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120917
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120916
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120915
Undefined behavior in the WebRTC: Networking component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120914
Spoofing issue in the Security component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120913
Sandbox escape in the Console component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120912
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120911
Same-origin policy bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120910
Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120909
Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120908
Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120907
Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...
EUVD-2026-120906
Incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 160 and Firefox ESR 153.7...