CVE-2026-3336 is a vulnerability in the AWS-LC cryptographic library's PKCS7_verify() function that allows unauthenticated users to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. This flaw affects aws-lc-sys versions from 0.24.0 up to but not including 0.38.0. The issue has been fixed in version 0.38.0. There is no workaround; users should upgrade to the latest release to mitigate this vulnerability. Customers using AWS cloud services are not required to take action as the vendor manages remediation for those services.
A timing side-channel vulnerability exists in the AES-CCM tag verification implementation in aws-lc-sys versions from 0.14.0 up to but not including 0.38.0. This flaw allows an unauthenticated attacker to potentially determine the validity of authentication tags by measuring timing discrepancies during decryption. The issue affects the EVP CIPHER API implementations EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. AWS customers using AWS services are not required to take action, but applications using aws-lc-sys should upgrade to version 0.38.0 or later. Workarounds exist only for specific AES-CCM parameter sets by using the EVP AEAD API with certain implementations; otherwise, upgrading is necessary.
Multiple high-impact security vulnerabilities have been identified and fixed in Mozilla Firefox, Firefox ESR, Thunderbird, and Firefox for iOS. These include issues such as spoofing via address bar desynchronization, use-after-free bugs, sandbox escapes, integer overflows, privilege escalations, information disclosures, and mitigation bypasses across various components including JavaScript engine, graphics, WebRTC, DOM, and networking. The fixes are included in Firefox for iOS 147.4 and Firefox 148 releases.
A vulnerability in the zlib compression library allows an attacker to cause a denial of service by triggering excessive CPU consumption. This occurs due to improper handling of negative length parameters in the CRC32 combine functions. The issue affects certain versions of zlib used in Debian and Ubuntu systems. Updates addressing this vulnerability have been released for Ubuntu 26.04 LTS and 24.04 LTS.
Multiple high-impact security vulnerabilities were fixed in Mozilla Firefox, Firefox ESR, Firefox for iOS, and Thunderbird. One vulnerability (CVE-2026-2032) in Firefox for iOS allows malicious scripts to interrupt new tab page loading, causing desynchronization between the address bar and page content, enabling website spoofing under trusted domains. Another vulnerability (CVE-2026-2447) is a heap buffer overflow in libvpx affecting Firefox and Firefox ESR. Fixes are available in Firefox for iOS 147.2.1, Firefox 147.0.4, and Firefox ESR versions 115.32.1 and 140.7.1.
Multiple security vulnerabilities have been identified in the Go programming language compiler, including a potential code smuggling issue via doc comments in cmd/cgo (CVE-2025-61732). These vulnerabilities affect Go versions prior to 1.25.7. Red Hat has issued a security advisory rating the update as important and has released patches to address these issues.
A use-after-free vulnerability exists in the Atomics Ops Handler component of quickjs-ng quickjs up to version 0.11.0. This flaw can be exploited remotely and has a high severity rating. Public exploit code is available, increasing the risk of exploitation. A patch identified by commit ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141 addresses this issue. Users are advised to apply the patch to mitigate the vulnerability.
This entry reports multiple vulnerabilities in the Go programming language (Golang). The description is minimal, stating only that Go is an open-source programming language. No specific technical details, impact, or remediation information is provided.
Python filelock versions prior to 3.20.3 contain a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the SoftFileLock implementation. This flaw allows a local attacker with filesystem access and symlink creation permissions to exploit a race window between permission checking and file creation, potentially causing lock operations to fail or behave unexpectedly. The issue has been fixed in version 3.20.3.
Coturn versions 4.6.2r5 through 4.7.0-r4 suffer from a flawed random number generator used for nonces and port randomization. The random numbers are generated using libc's random() instead of OpenSSL's RAND_bytes, making it possible for an attacker to reconstruct the RNG state by observing about 50 sequential nonces. This enables prediction of future nonces and relay ports, allowing authentication bypass with IP spoofing if credentials are known. A fix is available in commit 11fc465f4bba70bb0ad8aae17d6c4a63a29917d9.
A vulnerability in the nbconvert tool (jupyter nbconvert) affects versions up to and including 7.16.6 on Windows. When converting a Jupyter notebook containing SVG output to PDF, an attacker can place a malicious inkscape.bat file in the working directory. This batch file is executed unexpectedly during the conversion process, leading to arbitrary code execution. The issue is fixed in version 7.17.0.
Python filelock versions prior to 3.20.1 contain a Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability that allows local attackers to corrupt or truncate arbitrary user files via symlink attacks. This affects Unix, Linux, macOS, and Windows systems where filelock checks for a file's existence before opening it with truncation, enabling attackers to exploit the time gap by creating symlinks to victim files. The vulnerability requires local filesystem access and symlink creation capability. The issue is fixed in version 3.20.1. Partial mitigations include using SoftFileLock, restricting lock file directory permissions, and monitoring for suspicious symlinks, but upgrading is strongly recommended.
A vulnerability in the Qt Declarative module allows specially crafted input to cause excessive resource consumption, resulting in a denial of service. The flaw involves improper validation of the width and height attributes of image tags in the Text component of Qt Quick. This issue affects multiple Ubuntu LTS releases and can be mitigated by applying updates provided via Ubuntu Pro Extended Security Maintenance (ESM).
A vulnerability in PgBouncer before version 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication by exploiting an untrusted search path in the auth_query connection handler via a malicious search_path parameter in the StartupMessage.
The npm package 'citra-miemee22-sukiwir' is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags, alters version numbers, and continuously republishes variants to pollute the npm registry and inflate developer reputation scores.
The npm package citra-lupis45-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and changes version numbers to continuously republish variants, polluting the npm registry and inflating developer reputation scores.
The npm package citra-lontong89-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags, alter version numbers, and continuously republish variants, polluting the npm registry and inflating developer reputation scores.