Full List

Search

Recent Vulnerabilities

• CVE-2026-6763 • published on April 21, 2026 Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 150, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
• CVE-2026-6754 • published on April 21, 2026 Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
• CVE-2026-6752 • published on April 21, 2026 Incorrect boundary conditions in the WebRTC component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
• CVE-2026-6750 • published on April 21, 2026 Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
• CVE-2026-6749 • published on April 21, 2026 Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
• CVE-2026-6746 • published on April 21, 2026 Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 150, Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird 150, and Thunderbird 140.10.
• CVE-2026-70433 • published on August 5, 2026 Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
• CVE-2026-70427 • published on August 5, 2026 Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.
• CVE-2026-70376 • published on August 5, 2026 Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
• CVE-2026-70372 • published on August 4, 2026 Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
• CVE-2026-70370 • published on August 4, 2026 Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
• CVE-2026-70369 • published on August 4, 2026 Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.
• CVE-2026-70354 • published on August 11, 2026 Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
• CVE-2026-70338 • published on August 11, 2026 Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
• CVE-2026-70337 • published on August 11, 2026 Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
• CVE-2026-70335 • published on August 11, 2026 Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.
• CVE-2026-70330 • published on August 11, 2026 Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.
• CVE-2026-70329 • published on August 11, 2026 Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
• CVE-2026-70328 • published on August 11, 2026 Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
• CVE-2026-70325 • published on August 11, 2026 Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.