2026

TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerabili

Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a limit

Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached extension

Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-

Issue summary: A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through

Issue summary: QUIC process may keep memory for QUIC packet buffer for much longer period than necessary. Impact summar

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-eng

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dep

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attack

Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 202

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tenso

compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element i

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach

Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set Fil

Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix

The decoder in `readFromDataView` in lib0 before 0.2.119 can be tricked into reading more than it should from a buffer.

A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, le

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Check write tracking in all address s

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharac

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignm

OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasoni

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 140.1

Use-after-free in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox ESR 153.4, Thun

Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,

Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 1

Privilege escalation in the Places component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunde

Privilege escalation in the Address Bar component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, T

Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 15

Use-after-free in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderb

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 153.4

Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Thunderbird 157 and Firefox 157

Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,

Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbi

Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox

Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,

Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird

Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157

JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderb

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Th

Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 14

Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157,

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Th

Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 1

Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Fir