Threat database

Multiple vulnerabilities have been identified in Contao, an open source content management system used for creating websites and web applications. These issues affect versions prior to 5.3.54. A fixed version, 5.3.54, has been released to address these vulnerabilities.

Multiple high-impact security vulnerabilities have been identified and fixed in Mozilla Firefox and Thunderbird. These include issues such as sandbox escapes, use-after-free bugs, incorrect boundary conditions, privilege escalations, and same-origin policy bypasses affecting various components like graphics, DOM, networking, audio/video, and layout. The vulnerabilities affect Firefox versions prior to 160 and Firefox ESR versions prior to 115.45. Fixes are available in Firefox 160 and Firefox ESR 115.45.

A security vulnerability (CVE-2026-84042) in the crun OCI runtime on Red Hat Enterprise Linux (RHEL) allows execution of arbitrary code with administrator (root) privileges. This issue affects RHEL versions prior to 9 and 10. Red Hat has released security updates in versions 9 and 10 to address this flaw. The vulnerability involves the rootful krun with passt feature executing container payloads as the host root user.

Multiple vulnerabilities have been identified in various Fortinet products including FortiManager, FortiOS, FortiMail, FortiClient, and FortiAnalyzer. These products serve different security functions such as network security management, hardened operating systems for FortiGate platforms, email threat protection, endpoint protection with VPN, and log management and analysis. No specific details about the nature or impact of these vulnerabilities are provided.

Multiple vulnerabilities have been identified in various Microsoft developer tools and platforms, including Azure, Azure DevOps Server, PowerShell, ASP.NET, .NET Framework, Microsoft 365 Apps, Visual Studio, and Visual Studio Code. The information provided does not specify the nature, impact, or exploitation details of these vulnerabilities. Affected versions explicitly include versions 8 and 9 of an unspecified Microsoft product or component.

A vulnerability in the jwcrypto library used in Red Hat Enterprise Linux 9 allows a remote unauthenticated attacker to cause a denial of service by supplying a JSON Web Key (JWK) with an excessively large key_ops array. The key_ops member is validated using an inefficient O(n^2) algorithm without bounding the array length, leading to excessive CPU consumption during validation. This flaw affects Red Hat Enterprise Linux versions prior to 8.6 and has been fixed in version 8.6.

A denial of service vulnerability has been identified in Podman, a container runtime and management tool that operates without a separate daemon process. This vulnerability affects versions prior to 5.8.10. The issue has been addressed and fixed in version 5.8.10.

Multiple vulnerabilities in Checkmk, an IT monitoring software, allow for code execution. These issues affect versions prior to 3.0.0b1 and the 3.0.0b1 version itself. A fix is available starting with version 3.0.0b1.

Multiple vulnerabilities have been identified in AMD Zen 5 processors that could allow information disclosure. The details about the specific nature of these vulnerabilities or their exploitation are not provided. No affected versions or patch information is available at this time.

Multiple vulnerabilities have been identified in BusyBox, a software that consolidates various standard Unix utilities into a single executable. The details about the specific vulnerabilities, their impact, and affected versions are not provided.

The bsv-rs library versions before 0.8.5 and certain beta versions allow validation functions to incorrectly accept raw byte entries that are not valid transactions. This can lead to treating invalid data as valid transaction IDs and accepting entries that name these invalid entries as parents. The issue is fixed in versions 0.8.5 and 0.9.0-beta.7.0.

The bsv-rs library versions before 0.8.5 and certain beta versions allow transaction readers to accept trailing bytes after a parsed transaction. This causes the transaction's cached serialization and ID to include extra bytes, potentially resulting in a transaction being identified by a different ID than expected. The issue is fixed in versions 0.8.5 and 0.9.0-beta.7.0.

Multiple vulnerabilities have been identified in Composer, an open-source dependency manager for PHP projects. These issues affect versions prior to 2.11.2. The vulnerabilities have been addressed in version 2.11.2.

A vulnerability identified as CVE-2026-124249 affects Python versions distributed in Red Hat Hardened Images. This flaw allows manipulation of files, as noted by the Bundesamt für Sicherheit in der Informationstechnik. Red Hat has issued security advisories providing updated RPM packages for Python 3.11 and 3.12 that address this issue. The advisories include specific package versions that fix the vulnerability. No public exploit or in-the-wild exploitation has been reported to date.

Multiple denial of service vulnerabilities have been identified in the brace-expansion component used by nodejs-nodemon on Red Hat Enterprise Linux 10. These vulnerabilities involve uncontrolled recursion and stack exhaustion triggered by crafted brace patterns. A security update addressing these issues is available from Red Hat.

Multiple vulnerabilities have been identified in Synology DiskStation Manager (DSM), a web-based operating system for Synology NAS devices. These vulnerabilities affect versions prior to and including 7.4.1-90080-1. A fixed version, 7.4.1-90080-1, is available to address these issues.

A security update for the SUSE Linux Enterprise 16.0 kernel addresses multiple vulnerabilities across various kernel components including SMB client, netfilter, BPF, DRM, and others. These fixes resolve issues such as out-of-bounds reads, use-after-free bugs, information leaks, and validation errors. The update mitigates a broad range of security flaws identified by numerous CVEs.

This security update for Mozilla Firefox Extended Support Release 153.6.0 ESR addresses multiple vulnerabilities across various components including privilege escalation, remote code execution, sandbox escapes, information disclosure, use-after-free, and incorrect boundary conditions. The update fixes a broad range of issues affecting components such as DLL Services, Brotli decoder, DOM Navigation, Networking, Audio/Video, JavaScript engine, Graphics, Layout, CSS, SVG, and others. These vulnerabilities could lead to privilege escalation, remote code execution, sandbox escapes, and information leaks if exploited.

This security update for python-urllib3_1 addresses three vulnerabilities: CVE-2026-97687, which allows traffic interception due to possible HTTPS proxy TLS configuration override; CVE-2026-97688, a denial of service caused by an infinite loop during chunked Deflate decoding; and CVE-2026-97689, a denial of service resulting from unbounded memory allocation in the chunk parser.