  <vuln vid="1ed77d8e-53bb-11f1-b339-3497f65b111b">
    <topic>nginx-devel -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>nginx-devel</name>
	<range><lt>1.31.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The nginx project reports:</p>
	<blockquote cite="https://nginx.org/en/CHANGES">
	  <p>nginx 1.31.0 fixes multiple security issues affecting HTTP/2
	    proxying, rewrite handling, SCGI/uWSGI response handling, charset
	    conversion, HTTP/3 connection migration, and OCSP resolver response
	    processing.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-42926</cvename>
      <cvename>CVE-2026-42945</cvename>
      <cvename>CVE-2026-42946</cvename>
      <cvename>CVE-2026-42934</cvename>
      <cvename>CVE-2026-40460</cvename>
      <cvename>CVE-2026-40701</cvename>
      <url>https://nginx.org/en/CHANGES</url>
      <url>https://nginx.org/en/security_advisories.html</url>
    </references>
    <dates>
      <discovery>2026-05-13</discovery>
      <entry>2026-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="f69dbfcc-535b-11f1-8b62-8447094a420f">
    <topic>MySQL -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mysql80-client</name>
	<range><lt>8.0.46</lt></range>
      </package>
      <package>
	<name>mysql84-client</name>
	<range><lt>8.4.9</lt></range>
      </package>
      <package>
	<name>mysql96-client</name>
	<range><lt>9.6.1</lt></range>
      </package>
      <package>
	<name>mysql80-server</name>
	<range><lt>8.0.46</lt></range>
      </package>
      <package>
	<name>mysql84-server</name>
	<range><lt>8.4.9</lt></range>
      </package>
      <package>
	<name>mysql96-server</name>
	<range><lt>9.6.1</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="https://www.oracle.com/security-alerts/cpuapr2026.html">
	  <p>See linked CVE's for details.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-15467</cvename>
      <cvename>CVE-2026-34270</cvename>
      <cvename>CVE-2026-34271</cvename>
      <cvename>CVE-2026-34276</cvename>
      <cvename>CVE-2026-34308</cvename>
      <cvename>CVE-2026-22009</cvename>
      <cvename>CVE-2026-22017</cvename>
      <cvename>CVE-2026-34272</cvename>
      <cvename>CVE-2026-34303</cvename>
      <cvename>CVE-2025-14017</cvename>
      <cvename>CVE-2026-34318</cvename>
      <cvename>CVE-2026-34317</cvename>
      <cvename>CVE-2026-34319</cvename>
      <cvename>CVE-2026-22004</cvename>
      <cvename>CVE-2026-34304</cvename>
      <cvename>CVE-2026-35236</cvename>
      <cvename>CVE-2026-35237</cvename>
      <cvename>CVE-2026-35238</cvename>
      <cvename>CVE-2026-34293</cvename>
      <cvename>CVE-2026-35239</cvename>
      <cvename>CVE-2026-35235</cvename>
      <cvename>CVE-2026-21998</cvename>
      <cvename>CVE-2026-22005</cvename>
      <cvename>CVE-2026-22002</cvename>
      <cvename>CVE-2026-34267</cvename>
      <cvename>CVE-2026-34278</cvename>
      <cvename>CVE-2026-35240</cvename>
      <cvename>CVE-2026-35234</cvename>
      <cvename>CVE-2026-22015</cvename>
      <cvename>CVE-2026-22001</cvename>
      <url>https://www.oracle.com/security-alerts/cpuapr2026.html</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="31b7e7bc-5358-11f1-8b62-8447094a420f">
    <topic>MariaDB -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mariadb118-client</name>
	<range><lt>11.8.7</lt></range>
      </package>
      <package>
	<name>mariadb114-client</name>
	<range><lt>11.4.11</lt></range>
      </package>
      <package>
	<name>mariadb1011-client</name>
	<range><lt>10.11.17</lt></range>
      </package>
      <package>
	<name>mariadb106-client</name>
	<range><lt>10.6.26</lt></range>
      </package>
      <package>
	<name>mariadb118-server</name>
	<range><lt>11.8.7</lt></range>
      </package>
      <package>
	<name>mariadb114-server</name>
	<range><lt>11.4.11</lt></range>
      </package>
      <package>
	<name>mariadb1011-server</name>
	<range><lt>10.11.17</lt></range>
      </package>
      <package>
	<name>mariadb106-server</name>
	<range><lt>10.6.26</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The MariaDB project reports:</p>
	<blockquote cite="https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7">
	  <p>See linked CVE's for details.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-44173</cvename>
      <cvename>CVE-2026-44172</cvename>
      <cvename>CVE-2026-44171</cvename>
      <cvename>CVE-2026-44170</cvename>
      <cvename>CVE-2026-44169</cvename>
      <cvename>CVE-2026-44168</cvename>
      <url>https://mariadb.com/docs/release-notes/community-server/11.8/11.8.7</url>
      <url>https://mariadb.com/docs/release-notes/community-server/11.4/11.4.11</url>
      <url>https://mariadb.com/docs/release-notes/community-server/10.11/11.11.17</url>
      <url>https://mariadb.com/docs/release-notes/community-server/10.6/10.6.26</url>
    </references>
    <dates>
      <discovery>2026-05-18</discovery>
      <entry>2026-05-19</entry>
    </dates>
  </vuln>

  <vuln vid="f0f4bb64-52c6-11f1-a1c0-0050569f0b83">
    <topic>Vinyl/Varnish -- HTTP/2 parsing deficiency</topic>
    <affects>
      <package>
      <name>vinyl09</name>
      <range><lt>9.0.1</lt></range>
      </package>
      <package>
      <name>varnish7</name>
      <range><lt>7.7.3_1</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Vinyl Development Team reports:</p>
	<blockquote cite="https://vinyl-cache.org/security/VSV00019.html">
	  <p>A deficiency in HTTP/2 request parsing can be exploited to launch a backend request
	  desync attack (request smuggling), which in turn can be used for cache poisoning,
	  authentication bypass or possibly even information disclosure and manipulation.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://vinyl-cache.org/security/VSV00019.html</url>
    </references>
    <dates>
      <discovery>2026-05-18</discovery>
      <entry>2026-05-18</entry>
    </dates>
  </vuln>

  <vuln vid="7185ecc9-4fb7-11f1-bc50-6cc21735f730">
    <topic>PostgreSQL -- Multiple vulnerabilities</topic>
    <affects>
      <package>
       <name>postgresql14-server</name>
       <range><lt>14.23</lt></range>
      </package>
      <package>
       <name>postgresql15-server</name>
       <range><lt>15.18</lt></range>
      </package>
      <package>
       <name>postgresql16-server</name>
       <range><lt>16.14</lt></range>
      </package>
      <package>
       <name>postgresql17-server</name>
       <range><lt>17.10</lt></range>
      </package>
      <package>
       <name>postgresql18-server</name>
       <range><lt>18.4</lt></range>
      </package>
       <package>
       <name>postgresql14-client</name>
       <range><lt>14.23</lt></range>
      </package>
      <package>
       <name>postgresql15-client</name>
       <range><lt>15.18</lt></range>
      </package>
      <package>
       <name>postgresql16-client</name>
       <range><lt>16.14</lt></range>
      </package>
      <package>
       <name>postgresql17-client</name>
       <range><lt>17.10</lt></range>
      </package>
      <package>
       <name>postgresql18-client</name>
       <range><lt>18.4</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/">
	<p>
	  Missing authorization in PostgreSQL CREATE TYPE
	  allows an object creator to hijack other queries that use
	  search_path to find user-defined types, including
	  extension-defined types. That is to say, the victim will execute
	  arbitrary SQL functions of the attacker's choice.
	</p>
	<p>
	  Integer wraparound in multiple PostgreSQL server
	  features allows an application input provider to cause the
	  server to undersize an allocation and write out-of-bounds. This
	  results in a segmentation fault.
	</p>
	<p>
	  Externally-controlled format string in PostgreSQL timeofday()
	  function allows an attacker to retrieve portions of server
	  memory, via crafted timezone zones.
	</p>
	<p>
	  Symlink following in
	  PostgreSQL pg_basebackup plain format and in pg_rewind allows an
	  origin superuser to overwrite local files, e.g.
	  /var/lib/postgres/.bashrc, that hijack the operating system
	  account. It will remain the case that starting the server after
	  these commands implicitly trusts the origin superuser, due to
	  features like shared_preload_libraries. Hence, the attack has
	  practical implications only if one takes relevant action between
	  these commands and server start, like moving the files to a
	  different VM or snapshotting the VM.
	</p>
	<p>
	  SQL injection in PostgreSQL
	  pg_createsubscriber allows an attacker with
	  pg_create_subscription rights to execute arbitrary SQL as a
	  superuser. The attack takes effect when pg_createsubscriber next
	  runs. Versions before PostgreSQL 17 are unaffected.
	</p>
	<p>
	  PostgreSQL libpq lo_* functions let server superuser overwrite
	  client stack memory. Use of inherently dangerous function
	  PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(),
	  lo_read(), lo_lseek64(), and lo_tell64() functions allows the
	  server superuser to overwrite a client stack buffer with an
	  arbitrarily-large response. Like gets(), PQfn(...,
	  result_is_int=0, ...) stores arbitrary-length, server-determined
	  data into a buffer of unspecified size. Because both the
	  \lo_export command in psql and pg_dump call lo_read(), the
	  server superuser can overwrite pg_dump or psql stack memory.
	</p>
	<p>
	  PostgreSQL discloses MD5-hashed passwords via covert timing
	  channel. Covert timing channel in comparison of MD5-hashed
	  password in PostgreSQL authentication allows an attacker to
	  recover user credentials sufficient to authenticate. This does
	  not affect scram-sha-256 passwords, the default in all supported
	  releases. However, current databases may have MD5-hashed
	  passwords originating in upgrades from PostgreSQL 13 or earlier.
	</p>
	<p>
	  PostgreSQL SSL/GSS init causes denial of service, via
	  uncontrolled recursion. Uncontrolled recursion in PostgreSQL SSL
	  and GSS negotiation allows an attacker able to connect to a
	  PostgreSQL AF_UNIX socket to achieve sustained denial of
	  service. If SSL and GSS are both disabled, an attacker can do
	  the same via access to a PostgreSQL TCP socket.
	</p>
	<p>
	  PostgreSQL pg_restore_attribute_stats accepts values that cause
	  query planning to read past end of stats array. Buffer over-read
	  in PostgreSQL function pg_restore_attribute_stats() accepts
	  array values of unmatched length, which causes query planning to
	  read past end of one array. This allows a table maintainer to
	  infer memory values past that array end. Versions before
	  PostgreSQL 18 are unaffected.
	</p>
	<p>
	  PostgreSQL refint allows stack buffer overflow and SQL
	  injection. Stack buffer overflow in PostgreSQL module refint
	  allows an unprivileged database user to execute arbitrary code
	  as the operating system user running the database. A distinct
	  attack is possible if the application declares a user-controlled
	  column as a refint cascade primary key and facilitates
	  user-controlled updates to that column. In that case, a SQL
	  injection allows a primary key update value provider to execute
	  arbitrary SQL as the database user performing the primary key
	  update.
	</p>
	<p>
	  PostgreSQL REFRESH PUBLICATION allows SQL injection via table
	  name. SQL injection in PostgreSQL logical replication ALTER
	  SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table
	  creator to execute arbitrary SQL with the subscription's
	  publication-side credentials. The attack takes effect at the
	  next REFRESH PUBLICATION. Versions before PostgreSQL 16 are
	  unaffected.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6472</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6472/</url>
      <cvename>CVE-2026-6473</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6473/</url>
      <cvename>CVE-2026-6474</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6474/</url>
      <cvename>CVE-2026-6475</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6475/</url>
      <cvename>CVE-2026-6476</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6476/</url>
      <cvename>CVE-2026-6477</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6477/</url>
      <cvename>CVE-2026-6478</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6478/</url>
      <cvename>CVE-2026-6479</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6479/</url>
      <cvename>CVE-2026-6575</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6575/</url>
      <cvename>CVE-2026-6637</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6637/</url>
      <cvename>CVE-2026-6538</cvename>
      <url>https://www.postgresql.org/support/security/CVE-2026-6538/</url>
    </references>
    <dates>
      <discovery>2026-05-14</discovery>
      <entry>2026-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="3414ac89-4f9f-11f1-a1c0-0050569f0b83">
    <topic>www/nginx -- Remote Code Execution/DoS</topic>
    <affects>
<package>
<name>nginx</name>
<range><lt>1.30.1,3</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>nginx development team reports:</p>
	<blockquote cite="https://nginx.org/en/CHANGES-1.30">
	  <p>When using the "proxy_set_body" directive, an attacker
	  might inject data in the proxied request to an HTTP/2 backend</p>
	  <p>A heap memory buffer overflow might occur in a worker
	  process while handling a specially crafted request by
	  ngx_http_rewrite_module, potentially resulting in arbitrary code
	  execution</p>
	  <p>A heap memory buffer overread might occur in a worker
	  process while handling a specially crafted response by
	  ngx_http_scgi_module or ngx_http_uwsgi_module, allowing an attacker
	  to cause a disclosure of worker process memory or segmentation fault
	  in a worker process</p>
	  <p>A heap memory buffer overread might occur in a worker
	  process while handling a specially sent response with decoding from
	  UTF-8 via the "charset_map" directive, allowing an attacker to cause
	  a limited disclosure of worker proccess memory or segmentation fault
	  in a worker process</p>
	  <p>When using HTTP/3, processing of connection migration might
	  cause new QUIC streams to receive a new client address before
	  validation, allowing an attacker to cause address spoofing</p>
	  <p>use-after-free might occur during DNS server response
	  processing if the "ssl_ocsp" directive was used, allowing an attacker
	  to cause worker process memory corruption or segmentation fault in a
	  worker process</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-42926</cvename>
      <cvename>CVE-2026-42945</cvename>
      <cvename>CVE-2026-42946</cvename>
      <cvename>CVE-2026-42934</cvename>
      <cvename>CVE-2026-40460</cvename>
      <cvename>CVE-2026-40701</cvename>
    </references>
    <dates>
      <discovery>2026-05-14</discovery>
      <entry>2026-05-14</entry>
      <modified>2026-05-17</modified>
    </dates>
  </vuln>

  <vuln vid="6e701ad2-4f61-11f1-af6d-10ffe07f9334">
    <topic>mail/mailpit -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mailpit</name>
	<range><lt>1.30.0</lt></range>
      </package>
    </affects>
    <description>
       <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Mailpit author reports:</p>
       <blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.30.0">
	 <p>Set a default 50MB per message limit to prevent DoS via
	 unlimited SMTP DATA and /api/v1/send body sizes
	 (GHSA-fpxj-m5q8-fphw)</p>
	 <p>Include CGNAT (Carrier-Grade NAT) in internal IP checks
	 (GHSA-j3fj-qppj-fmmc)</p>
	 <p>Block internal IP access by default in HTML check
	 (GHSA-j3fj-qppj-fmmc)</p>
	 <p>Fix for path traversal &amp; arbitrary file write in
	 mailpit dump --http &lt;instance&gt; via attacker-controlled
	 message IDs (GHSA-qx5x-85p8-vg4j)</p>
	 <p>Fix concurrent map read &amp; write in proxy CSS rewriter
	 (GHSA-w4vj-r5pg-3722)</p>
       </blockquote>
       </body>
    </description>
    <references>
      <cvename>CVE-2026-45713</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-fpxj-m5q8-fphw</url>
      <cvename>CVE-2026-45709</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-j3fj-qppj-fmmc</url>
      <cvename>CVE-2026-45711</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-qx5x-85p8-vg4j</url>
      <cvename>CVE-2026-45712</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-w4vj-r5pg-3722</url>
    </references>
    <dates>
      <discovery>2026-05-14</discovery>
      <entry>2026-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="690144e9-4f88-11f1-982e-00a098b42aeb">
    <topic>py-setuptools -- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</topic>
    <affects>
    <package>
	<name>py27-setuptools44</name>
	<name>py310-setuptools58</name>
	<name>py311-setuptools58</name>
	<name>py312-setuptools58</name>
	<name>py313-setuptools58</name>
	<name>py313t-setuptools58</name>
	<name>py314-setuptools58</name>
	<name>py310-setuptools</name>
	<name>py311-setuptools</name>
	<name>py312-setuptools</name>
	<name>py313-setuptools</name>
	<name>py313t-setuptools</name>
	<name>py314-setuptools</name>
	<range><lt>78.1.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf reports:</p>
	<blockquote cite="https://github.com/pypa/setuptools/security/advisories/GHSA-5rjg-fvgr-3xxf">
	  <p>setuptools is a package that allows users to download, build,
	  install, upgrade, and uninstall Python packages. A path traversal
	  vulnerability in `PackageIndex` is present in setuptools prior to
	  version 78.1.1. An attacker would be allowed to write files to
	  arbitrary locations on the filesystem with the permissions of the
	  process running the Python code, which could escalate to remote
	  code execution depending on the context.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-47273</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2025-47273</url>
    </references>
    <dates>
      <discovery>2025-05-17</discovery>
      <entry>2026-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="b3cb8f40-4f4c-11f1-80f1-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.11.0</ge><lt>18.11.3</lt></range>
<range><ge>18.10.0</ge><lt>18.10.6</lt></range>
<range><ge>8.3.0</ge><lt>18.9.7</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-3-released/">
	  <p>Cross-site Scripting issue in Analytics dashboard chart rendering impacts GitLab EE</p>
	  <p>Cross-site Scripting issue in global search impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in Duo Agent output rendering impacts GitLab EE</p>
	  <p>Cross-site Scripting issue in Analytics Dashboard impacts GitLab EE</p>
	  <p>Denial of Service issue in CI/CD job update API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Duo Workflows API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in internal API endpoints impacts GitLab CE/EE</p>
	  <p>Improper Authorization issue in GraphQL token scope enforcement impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Insights Configuration impacts GitLab EE</p>
	  <p>Access Control issue in Issues API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in direct transfer CSV parser impacts GitLab CE/EE</p>
	  <p>CSRF issue in JiraConnect subscriptions impacts GitLab CE/EE</p>
	  <p>Confused Deputy issue in Jira integration impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in Banzai markdown sanitizer impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in achievement email notifications impacts GitLab CE/EE</p>
	  <p>Access Control issue in Helm package upload impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in NuGet Symbol Server impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in Container Registry protected tags impacts GitLab CE/EE</p>
	  <p>Missing Authorization issue in group user search impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in code owner approval rules impacts GitLab EE</p>
	  <p>Access Control issue in PyPI Package Protection Rules impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in issue links API impacts GitLab CE/EE</p>
	  <p>Server-Side Request Forgery issue in virtual registry redirect handler impacts GitLab EE</p>
	  <p>Access Control issue in GraphQL approval rule mutations impacts GitLab EE</p>
	  <p>Missing Authorization issue in Security Policy Project Reassignment impacts GitLab EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7481</cvename>
      <cvename>CVE-2026-5297</cvename>
      <cvename>CVE-2026-6073</cvename>
      <cvename>CVE-2026-7377</cvename>
      <cvename>CVE-2026-1659</cvename>
      <cvename>CVE-2025-14870</cvename>
      <cvename>CVE-2025-14869</cvename>
      <cvename>CVE-2026-1322</cvename>
      <cvename>CVE-2026-1184</cvename>
      <cvename>CVE-2026-4524</cvename>
      <cvename>CVE-2026-8280</cvename>
      <cvename>CVE-2026-4527</cvename>
      <cvename>CVE-2026-3160</cvename>
      <cvename>CVE-2026-6335</cvename>
      <cvename>CVE-2025-12669</cvename>
      <cvename>CVE-2026-3607</cvename>
      <cvename>CVE-2026-3074</cvename>
      <cvename>CVE-2026-1338</cvename>
      <cvename>CVE-2026-8144</cvename>
      <cvename>CVE-2026-6063</cvename>
      <cvename>CVE-2026-3073</cvename>
      <cvename>CVE-2025-13874</cvename>
      <cvename>CVE-2026-7471</cvename>
      <cvename>CVE-2026-2900</cvename>
      <cvename>CVE-2026-6883</cvename>
      <url>https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-3-released/</url>
    </references>
    <dates>
      <discovery>2026-05-13</discovery>
      <entry>2026-05-14</entry>
    </dates>
  </vuln>

  <vuln vid="e665f0a2-fe6d-44b0-ba9e-d383f055a8a3">
    <topic>zeek -- potential DoS vulnerability</topic>
    <affects>
	<package>
	    <name>zeek</name>
	    <range><lt>8.0.8</lt></range>
	</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p> Wojtulewicz of Corelight reports:</p>
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v8.0.8">
	  <p> A specially-crafted series of MIME headers sent via
	  SMTP or HTTP could cause Zeek to use large amounts of
	  memory and potentially crash. </p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/zeek/zeek/releases/tag/v8.0.8</url>
    </references>
    <dates>
      <discovery>2026-05-12</discovery>
      <entry>2026-05-12</entry>
    </dates>
  </vuln>

  <vuln vid="eeb4d69a-4d74-11f1-9a9c-994b98c88011">
    <topic>dnsmasq -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>dnsmasq</name>
	<range><lt>2.92rel2,1</lt></range>
      </package>
      <package> <!-- preannounced 2.93rc1, see https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html -->
	<name>dnsmasq-devel</name>
	<range><lt>2.93.r1,8</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Simon Kelley reports:</p>
	<blockquote cite="https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html">
	<p>
	Today, 11th May 2026 CERT is releasing a set of six CVEs for serious
	security vulnerabilities in dnsmasq. These are all long-standing
	bugs
	which apply to pretty much all non-ancient versions.
	</p>
	</blockquote>
	<p>
	Christopher Cullen and Molly Jaconski write, in Vulnerability Note
	VU#471747:
	</p>
	<blockquote cite="https://www.kb.cert.org/vuls/id/471747">
	<dl>
	  <dt>CVE-2026-2291</dt>
	  <dd>
	    dnsmasq's <code>extract_name()</code> function can be abused to
	    cause a heap buffer overflow, enabling an attacker to inject false
	    DNS cache entries. This could cause DNS queries to be redirected
	    to attacker-controlled IP addresses or result in a Denial of
	    Service (DoS).
	  </dd>
	  <dt>CVE-2026-4890</dt>
	  <dd>
	    An infinite-loop flaw in the DNSSEC validation of dnsmasq allows
	    remote attackers to cause Denial of Service (DoS) conditions via a
	    crafted DNS packet.
	  </dd>
	  <dt>CVE-2026-4891</dt>
	  <dd>
	    A heap-based out-of-bounds read vulnerability in the DNSSEC
	    validation of dnsmasq allows remote attackers to leak memory
	    information via a crafted DNS packet.
	  </dd>
	  <dt>CVE-2026-4892</dt>
	  <dd>
	    A heap-based out-of-bounds write vulnerability in the DHCPv6
	    implementation of dnsmasq allows local attackers to execute
	    arbitrary code with root privileges via a crafted DHCPv6 packet.
	  </dd>
	  <dt>CVE-2026-4893</dt>
	  <dd>
	    An information disclosure vulnerability in dnsmasq allows remote
	    attackers to bypass source checks via a crafted DNS packet
	    containing RFC 7871 client-subnet information.
	  </dd>
	  <dt>CVE-2026-5172</dt>
	  <dd>
	    A buffer overflow vulnerability in dnsmasq’s <code>extract_addresses()</code> function
	    allows attackers to trigger a heap out-of-bounds read and crash
	    dnsmasq by exploiting a malformed DNS response.
	  </dd>
	</dl>
	</blockquote>
      </body>
    </description>
    <references>
      <url>https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2026q2/018471.html</url>
      <url>https://www.kb.cert.org/vuls/id/471747</url>
      <cvename>CVE-2026-2291</cvename>
      <cvename>CVE-2026-4890</cvename>
      <cvename>CVE-2026-4891</cvename>
      <cvename>CVE-2026-4892</cvename>
      <cvename>CVE-2026-4893</cvename>
      <cvename>CVE-2026-5172</cvename>
    </references>
    <dates>
      <discovery>2026-03-25</discovery> <!-- earliest commit date for a fix -->
      <entry>2026-05-11</entry> <!-- publication/embargo date -->
    </dates>
  </vuln>

  <vuln vid="5b3b7f60-4de9-11f1-873e-0f64d023d0c7">
    <topic>postorius -- XSS</topic>
    <affects>
<package>
<name>py310-postorius</name>
<name>py311-postorius</name>
<name>py312-postorius</name>
<name>py313-postorius</name>
<name>py314-postorius</name>
<name>py315-postorius</name>
<range><lt>1.3.13_2</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>NIST reports:</p>
	<blockquote cite="https://nvd.nist.gov/vuln/detail/CVE-2026-44742">
	<p>
	Postorius through 1.3.13 does not escape HTML in the
	message subject when rendering it in the Held messages
	pop-up, as exploited in the wild in May 2026.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-44742</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-44742</url>
    </references>
    <dates>
      <discovery>2025-01-29</discovery>
      <entry>2026-05-12</entry>
    </dates>
  </vuln>

  <vuln vid="bacc1417-4d82-11f1-87f3-18dbf25a98c6">
    <topic>Vulnerability found in Expat</topic>
    <affects>
<package>
<name>expat</name>
<name>linux-c7-expat</name>
<name>linux-rl9-expat</name>
<range><lt>2.8.1</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<blockquote cite="https://blog.hartwork.org/posts/expat-2-8-1-released/">
	  <p>Expat 2.8.1 was released yesterday. The key motivation for cutting a release and doing so now was:</p>
	  <p>Fixing vulnerability CVE-2026-45186 that allows easy denial of service.</p>
	  <p>See also https://github.com/libexpat/libexpat/pull/1216</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-45186</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-45186</url>
    </references>
    <dates>
      <discovery>2025-10-01</discovery>
      <entry>2026-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="ab2258a2-4cea-11f1-aec8-bc241107513d">
    <topic>dash -- arith: INTMAX_MIN / -1 overflow</topic>
    <affects>
<package>
<name>dash</name>
<range><lt>0.5.13.3</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?id=0034bfe185d3d875cebace8cb3ca5c9dabf9e0f3 reports:</p>
	<blockquote cite="https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?id=0034bfe185d3d875cebace8cb3ca5c9dabf9e0f3">
	    <p>
		Division and remainder currently guard against division by zero, but not
		against the signed overflow case INTMAX_MIN / -1. On affected systems
		this can trigger SIGFPE during arithmetic expansion.
	    </p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-31323</cvename>
      <url>https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?id=0034bfe185d3d875cebace8cb3ca5c9dabf9e0f3</url>
    </references>
    <dates>
      <discovery>2026-04-13</discovery>
      <entry>2026-05-11</entry>
    </dates>
  </vuln>

  <vuln vid="818efa2a-4aae-11f1-88d3-b42e991fc52e">
    <topic>firefox ESR -- Other issue in the WebRTC component</topic>
    <affects>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2035939 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2035939">
	  <p>Other issue in the WebRTC component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-8094</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-8094</url>
    </references>
    <dates>
      <discovery>2026-05-07</discovery>
      <entry>2026-05-08</entry>
    </dates>
  </vuln>

  <vuln vid="7eae7f45-4aae-11f1-88d3-b42e991fc52e">
    <topic>firefox -- Memory safety bugs present in Firefox 150</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.2,2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	  <p>https://www.mozilla.org/en-US/security/advisories/mfsa2026-40/ reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2026-40/">
	<p>
	  Memory safety bugs present in Firefox 150.0.1. Some of
	  these bugs showed evidence of memory corruption and we
	  presume that with enough effort some of these could have
	  been exploited to run arbitrary code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-8093</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-8093</url>
    </references>
    <dates>
      <discovery>2026-05-07</discovery>
      <entry>2026-05-08</entry>
    </dates>
  </vuln>

  <vuln vid="7a9f1c15-4aae-11f1-88d3-b42e991fc52e">
    <topic>firefox -- Memory safety bugs present in Firefox ESR 115</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.2,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	  <p>https://www.mozilla.org/en-US/security/advisories/mfsa2026-40/ reports:</p>
	<blockquote cite="https://www.mozilla.org/en-US/security/advisories/mfsa2026-40/">
	<p>
	  Memory safety bugs. Some of these bugs showed evidence of
	  memory corruption and we presume that with enough effort
	  some of these could have been exploited to run arbitrary
	  code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-8092</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-8092</url>
    </references>
    <dates>
      <discovery>2026-05-07</discovery>
      <entry>2026-05-08</entry>
    </dates>
  </vuln>

  <vuln vid="76763f24-4aae-11f1-88d3-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2029301 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2029301">
	<p>
	  Incorrect boundary conditions in the Audio/Video: Playback
	  component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-8091</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-8091</url>
    </references>
    <dates>
      <discovery>2026-05-07</discovery>
      <entry>2026-05-08</entry>
    </dates>
  </vuln>

  <vuln vid="7360cdae-4aae-11f1-88d3-b42e991fc52e">
    <topic>firefox -- Use-after-free</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.2,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2034352 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2034352">
	  <p>Use-after-free in the DOM: Networking component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-8090</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-8090</url>
    </references>
    <dates>
      <discovery>2026-05-07</discovery>
      <entry>2026-05-08</entry>
    </dates>
  </vuln>

  <vuln vid="da4d7162-4aa3-11f1-b189-a8a1599412c6">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>148.0.7778.96</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>148.0.7778.96</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html">
	 <p>This update includes 127 security fixes:</p>
	 <p>Critical:</p>
	 <ul>
	    <li>[493747582] CVE-2026-7896: Integer overflow in Blink.</li>
	    <li>[504069514] CVE-2026-7897: Use after free in Mobile.</li>
	    <li>[504587882] CVE-2026-7898: Use after free in Chromoting.</li>
	</ul>
	<p>High:</p>
	<ul>
	    <li>[505481948] CVE-2026-7899: Out of bounds read and write in V8.</li>
	    <li>[496503799] CVE-2026-7900: Heap buffer overflow in ANGLE.</li>
	    <li>[497724490] CVE-2026-7901: Use after free in ANGLE.</li>
	    <li>[502030575] CVE-2026-7902: Out of bounds memory access in V8.</li>
	    <li>[491760376] CVE-2026-7903: Integer overflow in ANGLE.</li>
	    <li>[492350406] CVE-2026-7904: Out of bounds read in Fonts.</li>
	    <li>[495259842] CVE-2026-7905: Insufficient validation of untrusted input in Media.</li>
	    <li>[496284584] CVE-2026-7906: Use after free in SVG.</li>
	    <li>[496292089] CVE-2026-7907: Use after free in DOM.</li>
	    <li>[497436531] CVE-2026-7908: Use after free in Fullscreen.</li>
	    <li>[497437113] CVE-2026-7909: Inappropriate implementation in ServiceWorker.</li>
	    <li>[497543810] CVE-2026-7910: Use after free in Views.</li>
	    <li>[497548912] CVE-2026-7911: Use after free in Aura.</li>
	    <li>[497639714] CVE-2026-7912: Integer overflow in GPU.</li>
	    <li>[497936728] CVE-2026-7913: Insufficient policy enforcement in DevTools.</li>
	    <li>[498401609] CVE-2026-7914: Type Confusion in Accessibility.</li>
	    <li>[498454478] CVE-2026-7915: Insufficient data validation in DevTools.</li>
	    <li>[498720754] CVE-2026-7916: Insufficient data validation in InterestGroups.</li>
	    <li>[498752242] CVE-2026-7917: Use after free in Fullscreen.</li>
	    <li>[498780188] CVE-2026-7918: Use after free in GPU.</li>
	    <li>[498832921] CVE-2026-7919: Use after free in Aura.</li>
	    <li>[498989348] CVE-2026-7920: Use after free in Skia.</li>
	    <li>[499062376] CVE-2026-7921: Use after free in Passwords.</li>
	    <li>[499449324] CVE-2026-7922: Use after free in ServiceWorker.</li>
	    <li>[500080194] CVE-2026-7923: Out of bounds write in Skia.</li>
	    <li>[500087204] CVE-2026-7924: Uninitialized Use in Dawn.</li>
	    <li>[501833981] CVE-2026-7925: Use after free in Chromoting.</li>
	    <li>[502249087] CVE-2026-7926: Use after free in PresentationAPI.</li>
	    <li>[502830119] CVE-2026-7927: Type Confusion in Runtime.</li>
	    <li>[504612429] CVE-2026-7928: Use after free in WebRTC.</li>
	    <li>[504660052] CVE-2026-7929: Use after free in MediaRecording.</li>
	</ul>
	<p>Medium:</p>
	<ul>
	    <li>[434825208] CVE-2026-7930: Insufficient validation of untrusted input in Cookies.</li>
	    <li>[474338157] CVE-2026-7931: Insufficient validation of untrusted input in iOS.</li>
	    <li>[481634116] CVE-2026-7932: Insufficient policy enforcement in Downloads.</li>
	    <li>[488585490] CVE-2026-7933: Out of bounds read in WebCodecs.</li>
	    <li>[489023922] CVE-2026-7934: Insufficient validation of untrusted input in Popup Blocker.</li>
	    <li>[489624550] CVE-2026-7935: Inappropriate implementation in Speech.</li>
	    <li>[490485402] CVE-2026-7936: Object lifecycle issue in V8.</li>
	    <li>[491766258] CVE-2026-7937: Insufficient policy enforcement in DevTools.</li>
	    <li>[492735384] CVE-2026-7938: Use after free in CSS.</li>
	    <li>[492963096] CVE-2026-7939: Inappropriate implementation in SanitizerAPI.</li>
	    <li>[493631402] CVE-2026-7940: Use after free in V8.</li>
	    <li>[493955234] CVE-2026-7941: Insufficient validation of untrusted input in Mobile.</li>
	    <li>[495363705] CVE-2026-7942: Integer overflow in ANGLE.</li>
	    <li>[495373657] CVE-2026-7943: Insufficient validation of untrusted input in ANGLE.</li>
	    <li>[495783187] CVE-2026-7944: Insufficient validation of untrusted input in Persistent Cache.</li>
	    <li>[495802788] CVE-2026-7945: Insufficient validation of untrusted input in COOP.</li>
	    <li>[496016840] CVE-2026-7946: Insufficient policy enforcement in WebUI.</li>
	    <li>[496169594] CVE-2026-7947: Insufficient validation of untrusted input in Network.</li>
	    <li>[496193452] CVE-2026-7948: Race in Chromoting.</li>
	    <li>[496206134] CVE-2026-7949: Out of bounds read in Skia.</li>
	    <li>[496259890] CVE-2026-7950: Out of bounds read and write in GFX.</li>
	    <li>[496266456] CVE-2026-7951: Out of bounds write in WebRTC.</li>
	    <li>[496279876] CVE-2026-7952: Insufficient policy enforcement in Extensions.</li>
	    <li>[496379792] CVE-2026-7953: Insufficient validation of untrusted input in Omnibox.</li>
	    <li>[496380960] CVE-2026-7954: Race in Shared Storage.</li>
	    <li>[496441232] CVE-2026-7955: Uninitialized Use in GPU.</li>
	    <li>[496463315] CVE-2026-7956: Use after free in Navigation.</li>
	    <li>[496607380] CVE-2026-7957: Out of bounds write in Media.</li>
	    <li>[496632973] CVE-2026-7958: Inappropriate implementation in ServiceWorker.</li>
	    <li>[496645205] CVE-2026-7959: Inappropriate implementation in Navigation.</li>
	    <li>[497007825] CVE-2026-7960: Race in Speech.</li>
	    <li>[497008295] CVE-2026-7961: Insufficient validation of untrusted input in Permissions.</li>
	    <li>[497081987] CVE-2026-7962: Insufficient policy enforcement in DirectSockets.</li>
	    <li>[497250399] CVE-2026-7963: Inappropriate implementation in ServiceWorker.</li>
	    <li>[497254383] CVE-2026-7964: Insufficient validation of untrusted input in FileSystem.</li>
	    <li>[497255035] CVE-2026-7965: Insufficient validation of untrusted input in DevTools.</li>
	    <li>[497341787] CVE-2026-7966: Insufficient validation of untrusted input in SiteIsolation.</li>
	    <li>[497365545] CVE-2026-7967: Insufficient validation of untrusted input in Navigation.</li>
	    <li>[497432281] CVE-2026-7968: Insufficient validation of untrusted input in CORS.</li>
	    <li>[497450574] CVE-2026-7969: Integer overflow in Network.</li>
	    <li>[497487462] CVE-2026-7970: Use after free in TopChrome.</li>
	    <li>[497529290] CVE-2026-7971: Inappropriate implementation in ORB.</li>
	    <li>[497546281] CVE-2026-7972: Uninitialized Use in GPU.</li>
	    <li>[497565944] CVE-2026-7973: Integer overflow in Dawn.</li>
	    <li>[497649372] CVE-2026-7974: Use after free in Blink.</li>
	    <li>[497735587] CVE-2026-7975: Use after free in DevTools.</li>
	    <li>[497736679] CVE-2026-7976: Use after free in Views.</li>
	    <li>[497821223] CVE-2026-7977: Inappropriate implementation in Canvas.</li>
	    <li>[497828892] CVE-2026-7978: Inappropriate implementation in Companion.</li>
	    <li>[497849876] CVE-2026-7979: Inappropriate implementation in Media.</li>
	    <li>[497859275] CVE-2026-7980: Use after free in WebAudio.</li>
	    <li>[497926602] CVE-2026-7981: Out of bounds read in Codecs.</li>
	    <li>[497952533] CVE-2026-7982: Uninitialized Use in WebCodecs.</li>
	    <li>[497975608] CVE-2026-7983: Out of bounds read in Dawn.</li>
	    <li>[498277368] CVE-2026-7984: Use after free in ReadingMode.</li>
	    <li>[498352423] CVE-2026-7985: Use after free in GPU.</li>
	    <li>[498396238] CVE-2026-7986: Insufficient policy enforcement in Autofill.</li>
	    <li>[498696266] CVE-2026-7987: Use after free in WebRTC.</li>
	    <li>[498753456] CVE-2026-7988: Type Confusion in WebRTC.</li>
	    <li>[498765082] CVE-2026-7989: Insufficient data validation in DataTransfer.</li>
	    <li>[498892267] CVE-2026-7990: Insufficient validation of untrusted input in Updater.</li>
	    <li>[499065126] CVE-2026-7991: Use after free in UI.</li>
	    <li>[499067529] CVE-2026-7992: Insufficient validation of untrusted input in UI.</li>
	    <li>[499099003] CVE-2026-7993: Insufficient validation of untrusted input in Payments.</li>
	    <li>[499116954] CVE-2026-7994: Inappropriate implementation in Chromoting.</li>
	    <li>[501745798] CVE-2026-7995: Out of bounds read in AdFilter.</li>
	</ul>
	<p>Low:</p>
	<ul>
	    <li>[484547631] CVE-2026-7996: Insufficient validation of untrusted input in SSL.</li>
	    <li>[487960705] CVE-2026-7997: Insufficient validation of untrusted input in Updater.</li>
	    <li>[491676472] CVE-2026-7998: Insufficient validation of untrusted input in Dialog.</li>
	    <li>[493099941] CVE-2026-7999: Inappropriate implementation in V8.</li>
	    <li>[494464734] CVE-2026-8000: Insufficient validation of untrusted input in ChromeDriver.</li>
	    <li>[494764371] CVE-2026-8001: Use after free in Printing.</li>
	    <li>[495779613] CVE-2026-8002: Use after free in Audio.</li>
	    <li>[495985532] CVE-2026-8003: Insufficient validation of untrusted input in TabGroups.</li>
	    <li>[496189510] CVE-2026-8004: Insufficient policy enforcement in DevTools.</li>
	    <li>[496298665] CVE-2026-8005: Insufficient validation of untrusted input in Cast.</li>
	    <li>[496373088] CVE-2026-8006: Insufficient policy enforcement in DevTools.</li>
	    <li>[496399759] CVE-2026-8007: Insufficient validation of untrusted input in Cast.</li>
	    <li>[496426191] CVE-2026-8008: Inappropriate implementation in DevTools.</li>
	    <li>[496555077] CVE-2026-8009: Inappropriate implementation in Cast.</li>
	    <li>[496624084] CVE-2026-8010: Insufficient validation of untrusted input in SiteIsolation.</li>
	    <li>[496626029] CVE-2026-8011: Insufficient policy enforcement in Search.</li>
	    <li>[496628298] CVE-2026-8012: Inappropriate implementation in MHTML.</li>
	    <li>[497427430] CVE-2026-8013: Insufficient validation of untrusted input in FedCM.</li>
	    <li>[497490364] CVE-2026-8014: Inappropriate implementation in Preload.</li>
	    <li>[497548558] CVE-2026-8015: Inappropriate implementation in Media.</li>
	    <li>[497695401] CVE-2026-8016: Use after free in WebRTC.</li>
	    <li>[497722578] CVE-2026-8017: Side-channel information leakage in Media.</li>
	    <li>[498292657] CVE-2026-8018: Insufficient policy enforcement in DevTools.</li>
	    <li>[498353173] CVE-2026-8019: Insufficient policy enforcement in WebApp.</li>
	    <li>[498382925] CVE-2026-8020: Uninitialized Use in GPU.</li>
	    <li>[498417031] CVE-2026-8021: Script injection in UI.</li>
	    <li>[499194407] CVE-2026-8022: Inappropriate implementation in MHTML.</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-7896</cvename>
      <cvename>CVE-2026-7897</cvename>
      <cvename>CVE-2026-7898</cvename>
      <cvename>CVE-2026-7899</cvename>
      <cvename>CVE-2026-7900</cvename>
      <cvename>CVE-2026-7901</cvename>
      <cvename>CVE-2026-7902</cvename>
      <cvename>CVE-2026-7903</cvename>
      <cvename>CVE-2026-7904</cvename>
      <cvename>CVE-2026-7905</cvename>
      <cvename>CVE-2026-7906</cvename>
      <cvename>CVE-2026-7907</cvename>
      <cvename>CVE-2026-7908</cvename>
      <cvename>CVE-2026-7909</cvename>
      <cvename>CVE-2026-7910</cvename>
      <cvename>CVE-2026-7911</cvename>
      <cvename>CVE-2026-7912</cvename>
      <cvename>CVE-2026-7913</cvename>
      <cvename>CVE-2026-7914</cvename>
      <cvename>CVE-2026-7915</cvename>
      <cvename>CVE-2026-7916</cvename>
      <cvename>CVE-2026-7917</cvename>
      <cvename>CVE-2026-7918</cvename>
      <cvename>CVE-2026-7919</cvename>
      <cvename>CVE-2026-7920</cvename>
      <cvename>CVE-2026-7921</cvename>
      <cvename>CVE-2026-7922</cvename>
      <cvename>CVE-2026-7923</cvename>
      <cvename>CVE-2026-7924</cvename>
      <cvename>CVE-2026-7925</cvename>
      <cvename>CVE-2026-7926</cvename>
      <cvename>CVE-2026-7927</cvename>
      <cvename>CVE-2026-7928</cvename>
      <cvename>CVE-2026-7929</cvename>
      <cvename>CVE-2026-7930</cvename>
      <cvename>CVE-2026-7931</cvename>
      <cvename>CVE-2026-7932</cvename>
      <cvename>CVE-2026-7933</cvename>
      <cvename>CVE-2026-7934</cvename>
      <cvename>CVE-2026-7935</cvename>
      <cvename>CVE-2026-7936</cvename>
      <cvename>CVE-2026-7937</cvename>
      <cvename>CVE-2026-7938</cvename>
      <cvename>CVE-2026-7939</cvename>
      <cvename>CVE-2026-7940</cvename>
      <cvename>CVE-2026-7941</cvename>
      <cvename>CVE-2026-7942</cvename>
      <cvename>CVE-2026-7943</cvename>
      <cvename>CVE-2026-7944</cvename>
      <cvename>CVE-2026-7945</cvename>
      <cvename>CVE-2026-7946</cvename>
      <cvename>CVE-2026-7947</cvename>
      <cvename>CVE-2026-7948</cvename>
      <cvename>CVE-2026-7949</cvename>
      <cvename>CVE-2026-7950</cvename>
      <cvename>CVE-2026-7951</cvename>
      <cvename>CVE-2026-7952</cvename>
      <cvename>CVE-2026-7953</cvename>
      <cvename>CVE-2026-7954</cvename>
      <cvename>CVE-2026-7955</cvename>
      <cvename>CVE-2026-7956</cvename>
      <cvename>CVE-2026-7957</cvename>
      <cvename>CVE-2026-7958</cvename>
      <cvename>CVE-2026-7959</cvename>
      <cvename>CVE-2026-7960</cvename>
      <cvename>CVE-2026-7961</cvename>
      <cvename>CVE-2026-7962</cvename>
      <cvename>CVE-2026-7963</cvename>
      <cvename>CVE-2026-7964</cvename>
      <cvename>CVE-2026-7965</cvename>
      <cvename>CVE-2026-7966</cvename>
      <cvename>CVE-2026-7967</cvename>
      <cvename>CVE-2026-7968</cvename>
      <cvename>CVE-2026-7969</cvename>
      <cvename>CVE-2026-7970</cvename>
      <cvename>CVE-2026-7971</cvename>
      <cvename>CVE-2026-7972</cvename>
      <cvename>CVE-2026-7973</cvename>
      <cvename>CVE-2026-7974</cvename>
      <cvename>CVE-2026-7975</cvename>
      <cvename>CVE-2026-7976</cvename>
      <cvename>CVE-2026-7977</cvename>
      <cvename>CVE-2026-7978</cvename>
      <cvename>CVE-2026-7979</cvename>
      <cvename>CVE-2026-7980</cvename>
      <cvename>CVE-2026-7981</cvename>
      <cvename>CVE-2026-7982</cvename>
      <cvename>CVE-2026-7983</cvename>
      <cvename>CVE-2026-7984</cvename>
      <cvename>CVE-2026-7985</cvename>
      <cvename>CVE-2026-7986</cvename>
      <cvename>CVE-2026-7987</cvename>
      <cvename>CVE-2026-7988</cvename>
      <cvename>CVE-2026-7989</cvename>
      <cvename>CVE-2026-7990</cvename>
      <cvename>CVE-2026-7991</cvename>
      <cvename>CVE-2026-7992</cvename>
      <cvename>CVE-2026-7993</cvename>
      <cvename>CVE-2026-7994</cvename>
      <cvename>CVE-2026-7995</cvename>
      <cvename>CVE-2026-7996</cvename>
      <cvename>CVE-2026-7997</cvename>
      <cvename>CVE-2026-7998</cvename>
      <cvename>CVE-2026-7999</cvename>
      <cvename>CVE-2026-8000</cvename>
      <cvename>CVE-2026-8001</cvename>
      <cvename>CVE-2026-8002</cvename>
      <cvename>CVE-2026-8003</cvename>
      <cvename>CVE-2026-8004</cvename>
      <cvename>CVE-2026-8005</cvename>
      <cvename>CVE-2026-8006</cvename>
      <cvename>CVE-2026-8007</cvename>
      <cvename>CVE-2026-8008</cvename>
      <cvename>CVE-2026-8009</cvename>
      <cvename>CVE-2026-8010</cvename>
      <cvename>CVE-2026-8011</cvename>
      <cvename>CVE-2026-8012</cvename>
      <cvename>CVE-2026-8013</cvename>
      <cvename>CVE-2026-8014</cvename>
      <cvename>CVE-2026-8015</cvename>
      <cvename>CVE-2026-8016</cvename>
      <cvename>CVE-2026-8017</cvename>
      <cvename>CVE-2026-8018</cvename>
      <cvename>CVE-2026-8019</cvename>
      <cvename>CVE-2026-8020</cvename>
      <cvename>CVE-2026-8021</cvename>
      <cvename>CVE-2026-8022</cvename>
      <url>https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html</url>
    </references>
    <dates>
      <discovery>2026-05-05</discovery>
      <entry>2026-05-08</entry>
    </dates>
  </vuln>

  <vuln vid="67e31a04-49fa-11f1-9b23-b42e991fc52e">
    <topic>MongoDB Server -- Multiple vulnerabilities</topic>
    <affects>
    <package>
	<name>mongodb80</name>
	<range><lt>8.0.21</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://jira.mongodb.org/browse/SERVER-119981 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-119981">
	<ul>
	    <li>
	    Computing the MD5 checksum of a malformed BSON object
	    under specific conditions may cause loss of availability
	    in MongoDB server.
	    </li>
	    <li>
	    An authorization flaw in the user management command
	    could allow an authenticated user to make limited
	    changes to authentication-related data associated with
	    another user account. This could affect how
	    authentication is performed for the impacted account.
	    </li>
	</ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6914</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6914</url>
      <cvename>CVE-2026-6915</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6915</url>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-05-07</entry>
    </dates>
  </vuln>

  <vuln vid="9b5d6fbb-4893-11f1-82bf-3c7c3fba4204">
    <topic>devel/ocaml-opam -- CWE-24 Path Traversal: '../filedir'</topic>
    <affects>
    <package>
	<name>ocaml-opam</name>
	<range><lt>2.5.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p><a href="https://github.com/ocaml/opam/releases/tag/2.5.1">https://github.com/ocaml/opam/releases/tag/2.5.1</a> reports:</p>
	<blockquote cite="https://github.com/ocaml/opam/releases/tag/2.5.1">
	  <p>In OCaml opam before 2.5.1, a .install field containing a destination
filepath can use ../ to reach a parent directory.</p>
	<p>Reported by <a href="https://github.com/andrew">Andrew Nesbitt</a> &lt;andrewnez@gmail.com&gt;.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-41082</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-41082</url>
    </references>
    <dates>
      <discovery>2026-04-16</discovery>
      <entry>2026-05-05</entry>
    </dates>
  </vuln>

  <vuln vid="1ccc383b-486a-11f1-8b62-8447094a420f">
    <topic>www/apache24 -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>apache24</name>
	<range><lt>2.4.67</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Apache httpd project reports:</p>
	<blockquote cite="https://dlcdn.apache.org/httpd/CHANGES_2.4.67">
	  <p>mod_proxy_ajp: CVE-2026-34059, CVE-2026-34032, CVE-2026-33857, CVE-2026-28780</p>
	  <p>multiple modules: CVE-2026-33523</p>
	  <p>mod_authn_socache: CVE-2026-33007</p>
	  <p>mod_auth_digest: CVE-2026-33006</p>
	  <p>mod_dav_lock: mod_dav_lock</p>
	  <p>mod_md: CVE-2026-29168</p>
	  <p>mod_rewrite: CVE-2026-24072</p>
	  <p>mod_http2: CVE-2026-23918</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-34059</cvename>
      <cvename>CVE-2026-34032</cvename>
      <cvename>CVE-2026-33857</cvename>
      <cvename>CVE-2026-33523</cvename>
      <cvename>CVE-2026-33007</cvename>
      <cvename>CVE-2026-33006</cvename>
      <cvename>CVE-2026-29169</cvename>
      <cvename>CVE-2026-29168</cvename>
      <cvename>CVE-2026-28780</cvename>
      <cvename>CVE-2026-24072</cvename>
      <cvename>CVE-2026-23918</cvename>
      <url>https://dlcdn.apache.org/httpd/CHANGES_2.4.67</url>
    </references>
    <dates>
      <discovery>2026-05-04</discovery>
      <entry>2026-05-05</entry>
    </dates>
  </vuln>

  <vuln vid="3c02dcfd-47d7-11f1-99fb-3497f65b111b">
    <topic>modsecurity3 -- multiple vulnerabilities</topic>
    <affects>
      <package>
       <name>modsecurity3</name>
       <range><lt>3.0.15</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>
       ModSecurity is an open source web application firewall engine.
       </p>
       <p>
       According to the upstream changelog, multiple vulnerabilities have been fixed.
       </p>
       <ul>
       <li>CVE-2026-42268: unsigned integer underflow in verify operators</li>
       <li>CVE-2026-30923: buffer overflow in hex_decode</li>
       </ul>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-42268</cvename>
      <cvename>CVE-2026-30923</cvename>
      <url>https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.15/CHANGES</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-05-04</entry>
    </dates>
  </vuln>

  <vuln vid="e4a08820-470d-11f1-be75-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.1,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2028537%2C2029911%2C2031121%2C2033602 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2028537%2C2029911%2C2031121%2C2033602">
	<p>
	Memory safety bugs. Some of these bugs showed evidence of
	memory corruption and we presume that with enough effort
	some of these could have been exploited to run arbitrary
	code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7323</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7323</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-05-03</entry>
    </dates>
  </vuln>

  <vuln vid="a420f545-442c-11f1-b9b5-589cfc0dc9a2">
    <topic>Prosody XMPP server advisory 2026-04-29</topic>
    <affects>
      <package>
      <name>prosody</name>
      <range><lt>13.0.5</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Prosody team reports:</p>
	<blockquote cite="https://prosody.im/security/advisory_735dd9d3/">
	<p>Traffic patterns were discovered which can cause Prosody to consume excessive
	amounts of memory with much smaller amounts of incoming traffic. This traffic
	can be sent by unauthenticated connections. It was discovered that
	mod_proxy65’s access control was broken and incomplete due to two bugs.</p>
	<p>The issue with unpausing connections was discovered and disclosed by <a href="https://github.com/MaxHearnden">Max Hearnden</a>.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-43504</cvename>
      <cvename>CVE-2026-43505</cvename>
      <cvename>CVE-2026-43506</cvename>
      <cvename>CVE-2026-43507</cvename>
      <url>https://prosody.im/security/advisory_735dd9d3/</url>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
      <modified>2026-05-08</modified>
    </dates>
  </vuln>

  <vuln vid="7ebfb0bf-44b4-11f1-8b82-3c7c3fba4204">
    <topic>Text::CSV_XS -- CWE-825 Expired Pointer Dereference</topic>
    <affects>
    <package>
	<name>p5-Text-CSV_XS</name>
	<range><lt>1.62</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>H.Merijn Brand - Tux &lt;linux@tux.freedom.nl&gt; reports:</p>
	<blockquote cite="https://github.com/cpan-authors/Text-CSV_XS/commit/c17f31a5f2bf36674748eb4b6e25672f0571a224.patch">
	  <p>Text::CSV_XS versions before 1.62 for Perl have a use-after-free
when registered callbacks extend the Perl argument stack, which may
enable type confusion or memory corruption.

The Parse, print, getline, and getline_all methods invoke registered
callbacks (for example after_parse, before_print, or on_error) and
cache the Perl argument stack pointer across the call.  If a callback
extends the argument stack enough to trigger a reallocation, the
return value is written through the stale pointer into the freed
buffer, and the caller reads the original $self argument as the
return value instead.

Calling code that expects parsed data from getline_all receives the
Text::CSV_XS object in its place, leading to logic errors or crashes.
Text::CSV_XS objects used without any registered callbacks are not
affected.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7111</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7111</url>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="c3a9c5a6-4435-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Heap overflow in libnv</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_7</lt></range>
	<range><ge>14.4</ge><lt>14.4_3</lt></range>
	<range><ge>14.3</ge><lt>14.3_12</lt></range>
	<range><ge>13.5</ge><lt>13.5_13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>When processing the header of an incoming message, libnv failed
	  to properly validate the message size.</p>
	<h1>Impact:</h1>
	  <p>The lack of validation allows a malicious program to write
	  outside the bounds of a heap allocation.  This can trigger a crash
	  or system panic, and it may be possible for an unprivileged user
	  to exploit the bug to elevate their privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-35547</cvename>
      <freebsdsa>SA-26:17.libnv</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="892fabf5-4435-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Stack overflow via select() file descriptor set overflow</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_7</lt></range>
	<range><ge>14.4</ge><lt>14.4_3</lt></range>
	<range><ge>14.3</ge><lt>14.3_12</lt></range>
	<range><ge>13.5</ge><lt>13.5_13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>When exchanging data over a socket, libnv uses select(2) to
	  wait for data to arrive.  However, it does not verify whether the
	  provided socket descriptor fits in select(2)'s file descriptor set
	  size limit of FD_SETSIZE (1024).</p>
	<h1>Impact:</h1>
	  <p>An attacker who is able to force a libnv application to allocate
	  large file descriptors, e.g., by opening many descriptors and
	  executing a program which is not careful to close them upon startup,
	  can trigger stack corruption.  If the target application is
	  setuid-root, then this could be used to elevate local privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-39457</cvename>
      <freebsdsa>SA-26:16.libnv</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="58acf4c5-4435-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Remotely triggerable out-of-bounds heap write in dhclient</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_7</lt></range>
	<range><ge>14.4</ge><lt>14.4_3</lt></range>
	<range><ge>14.3</ge><lt>14.3_12</lt></range>
	<range><ge>13.5</ge><lt>13.5_13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>As dhclient is building an environment to pass to dhclient-script,
	  it may need to resize the array of string pointers.  The code which
	  expands the array incorrectly calculates its new size when requesting
	  memory, resulting in a heap buffer overrun.</p>
	<h1>Impact:</h1>
	  <p>A specially crafted packet can cause dhclient to overrun its
	  buffer of environment entries.  This can result in a crash, but it
	  may be possible to leverage this bug to achieve remote code
	  execution.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-42512</cvename>
      <freebsdsa>SA-26:15.dhclient</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="225ba563-4435-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- pf can overflow the stack parsing crafted SCTP packets</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_7</lt></range>
	<range><ge>14.4</ge><lt>14.4_3</lt></range>
	<range><ge>14.3</ge><lt>14.3_12</lt></range>
	<range><ge>13.5</ge><lt>13.5_13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>Incorrect packet validation allowed unbounded recursion parsing
	  SCTP chunk parameters.  This can eventually result in a stack
	  overflow and panic.</p>
	<h1>Impact:</h1>
	  <p>Remote attackers can craft packets which cause affected systems
	  to panic.  This affects any system where pf is configured to process
	  traffic, independent of the configured ruleset.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-7164</cvename>
      <freebsdsa>SA-26:14.pf</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="f528ea29-4434-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Local privilege escalation via execve()</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_7</lt></range>
	<range><ge>14.4</ge><lt>14.4_3</lt></range>
	<range><ge>14.3</ge><lt>14.3_12</lt></range>
	<range><ge>13.5</ge><lt>13.5_13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>An operator precedence bug in the kernel results in a scenario
	  where a buffer overflow causes attacker-controlled data to overwrite
	  adjacent execve(2) argument buffers.</p>
	<h1>Impact:</h1>
	  <p>The bug may be exploitable by an unprivileged user to obtain
	  superuser privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-7270</cvename>
      <freebsdsa>SA-26:13.exec</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="9eb2533e-4434-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Remote code execution via malicious DHCP options</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_7</lt></range>
	<range><ge>14.4</ge><lt>14.4_3</lt></range>
	<range><ge>14.3</ge><lt>14.3_12</lt></range>
	<range><ge>13.5</ge><lt>13.5_13</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>The BOOTP file field is written to the lease file without
	  escaping embedded double-quotes, allowing injection of arbitrary
	  dhclient.conf directives.  When the lease file is subsequently
	  re-parsed by dhclient, e.g., after a system restart, an attacker-controlled
	  field from the lease is passed to dhclient-script(8), which evaluates
	  it.</p>
	<h1>Impact:</h1>
	  <p>A rogue DHCP server may be able to execute arbirary code as
	  root on a system running dhclient.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-42511</cvename>
      <freebsdsa>SA-26:12.dhclient</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-30</entry>
    </dates>
  </vuln>

  <vuln vid="787cde46-4424-11f1-943f-05b19d100dca">
    <topic>openexr -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>openexr</name>
	<range><lt>3.4.11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cary Phillips reports:</p>
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11">
	  <p>[OpenEXR v3.4.11 is a p]atch release that addresses the following security vulnerabilities:</p>
	  <ul>
	    <li>CVE-2026-42217 Shift exponent overflow in readVariableLengthInteger() (ImfIDManifest.cpp)</li>
	    <li>CVE-2026-42216 Out-of-bounds read in IDManifest::init() during prefix expansion</li>
	    <li>CVE-2026-41142 Integer overflow in ImageChannel::resize leads to heap OOB write via OpenEXRUtil public API</li>
	    <li>OSS-fuzz 504280155 Heap-buffer-overflow in DwaCompressor_uncompress</li>
	    <li>OSS-fuzz 505062709 Null-dereference READ in Imf_3_3::prefixFromLayerName</li>
	  </ul>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-42217</cvename>
      <cvename>CVE-2026-42216</cvename>
      <cvename>CVE-2026-41142</cvename>
      <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.11</url>
    </references>
    <dates>
      <discovery>2026-04-29</discovery>
      <entry>2026-04-29</entry>
    </dates>
  </vuln>

  <vuln vid="98c23e2b-43c7-11f1-a190-b42e991fc52e">
    <topic>Mozilla -- Sandbox escape</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox</name>
	<range><lt>140.10.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2029461 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2029461">
	<p>
	Sandbox escape due to incorrect boundary conditions in the
	WebRTC: Networking component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7321</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7321</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-04-29</entry>
    </dates>
  </vuln>

  <vuln vid="5a44e168-4394-11f1-a190-b42e991fc52e">
    <topic>firefox -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.1,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021904%2C2022731%2C2027158%2C2027733%2C2027973%2C2027976%2C2028231%2C2028731%2C2028886%2C2029067%2C2029700%2C2029724%2C2029806%2C2029814%2C2030108%2C2030111%2C2031524%2C2031921%2C2032040 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021904%2C2022731%2C2027158%2C2027733%2C2027973%2C2027976%2C2028231%2C2028731%2C2028886%2C2029067%2C2029700%2C2029724%2C2029806%2C2029814%2C2030108%2C2030111%2C2031524%2C2031921%2C2032040">
	<p>
	Memory safety bugs. Some of these bugs showed evidence of
	memory corruption and we presume that with enough effort
	some of these could have been exploited to run arbitrary
	code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7322</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7322</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-04-29</entry>
    </dates>
  </vuln>

  <vuln vid="581838b8-4394-11f1-a190-b42e991fc52e">
    <topic>firefox -- Information disclosure</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.1,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2027433 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2027433">
	<p>
	Information disclosure due to incorrect boundary
	conditions in the Audio/Video component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7320</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7320</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-04-29</entry>
    </dates>
  </vuln>

  <vuln vid="560f4838-4394-11f1-a190-b42e991fc52e">
    <topic>firefox -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.1,2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029419%2C2029717%2C2029769%2C2029886 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2029419%2C2029717%2C2029769%2C2029886">
	<p>
	Memory safety bugs. Some of these bugs showed evidence of
	memory corruption and we presume that with enough effort
	some of these could have been exploited to run arbitrary
	code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7324</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7324</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-04-29</entry>
    </dates>
  </vuln>

  <vuln vid="53ff336e-4394-11f1-a190-b42e991fc52e">
    <topic>firefox -- Information disclosure</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.1,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2027433 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2027433">
	<p>
	Information disclosure due to incorrect boundary
	conditions in the Audio/Video component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-7320</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-7320</url>
    </references>
    <dates>
      <discovery>2026-04-28</discovery>
      <entry>2026-04-29</entry>
    </dates>
  </vuln>

  <vuln vid="6f1af47d-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2010727%2C2019004%2C2019224%2C2019547%2C2020378%2C2022381%2C2022608%2C2022785%2C2023120%2C2023128%2C2023140%2C2023279%2C2023836%2C2023882%2C2023925%2C2023950%2C2023959%2C2023965%2C2024243%2C2024245%2C2024247%2C2024253%2C2024346%2C2024357%2C2024416%2C2024420%2C2024429%2C2024432%2C2024455%2C2024466%2C2024468%2C2024476%2C2024664%2C2024666%2C2024669%2C2024670%2C2024671%2C2024761%2C2024918%2C2025292%2C2025332%2C2025348%2C2025384%2C2025395%2C2025458%2C2025461%2C2025463%2C2025481%2C2025483%2C2025485%2C2025494%2C2025506%2C2025511%2C2025513%2C2025520%2C2026277%2C2026282%2C2026288%2C2026289%2C2026311%2C2026312%2C2026869%2C2027152%2C2027161%2C2027238%2C2027261%2C2027269%2C2027274%2C2027280%2C2027281%2C2027300%2C2027302%2C2027331%2C2027339%2C2027340%2C2027738%2C2027975%2C2028000%2C2028011%2C2028289%2C2028525%2C2028728%2C2028887%2C2028888%2C2028896%2C2029063%2C2029064%2C2029290%2C2029291%2C2029294%2C2029300%2C2029304%2C2029316%2C2029317%2C2029401%2C2029415%2C2029430%2C2029457%2C2029727%2C2029735%2C2029743%2C2029752%2C2029754%2C2029776%2C2029809%2C2030324%2C2030370">
	<p>
	Memory safety bugs present. Some of these bugs showed
	evidence of memory corruption and we presume that with
	enough effort some of these could have been exploited to
	run arbitrary code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6786</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6786</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="6c9ca7e3-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=1935995%2C1999158%2C2015952%2C2021909%2C2022026%2C2022041%2C2022088%2C2022276%2C2022335%2C2022338%2C2022373%2C2022597%2C2022874%2C2023276%2C2023544%2C2023551%2C2023599%2C2023608%2C2023814%2C2024233%2C2024239%2C2024241%2C2024242%2C2024250%2C2024251%2C2024343%2C2024422%2C2024425%2C2024440%2C2024442%2C2024446%2C2024458%2C2024463%2C2024478%2C2024650%2C2024653%2C2024654%2C2024655%2C2024656%2C2024661%2C2024662%2C2024668%2C2024919%2C2025278%2C2025349%2C2025350%2C2025354%2C2025360%2C2025363%2C2025370%2C2025379%2C2025381%2C2025399%2C2025400%2C2025403%2C2025407%2C2025415%2C2025420%2C2025427%2C2025429%2C2025430%2C2025479%2C2025489%2C2025493%2C2025497%2C2025502%2C2025515%2C2025517%2C2025526%2C2025609%2C2025948%2C2025949%2C2025951%2C2025953%2C2025955%2C2025962%2C2025969%2C2025970%2C2025971%2C2025973%2C2025976%2C2025977%2C2026280%2C2026285%2C2026293%2C2026296%2C2026310%2C2027237%2C2027260%2C2027268%2C2027277%2C2027284%2C2027291%2C2027293%2C2027298%2C2027330%2C2027342%2C2027345%2C2027359%2C2027365%2C2027378%2C2027754%2C2027959%2C2027962%2C2027964%2C2027971%2C2027974%2C2027979%2C2027982%2C2027995%2C2028001%2C2028267%2C2028268%2C2028275%2C2028288%2C2028290%2C2028291%2C2028528%2C2028551%2C2028627%2C2028879%2C2028889%2C2029061%2C2029071%2C2029283%2C2029296%2C2029314%2C2029323%2C2029411%2C2029423%2C2029424%2C2029425%2C2029427%2C2029436%2C2029440%2C2029449%2C2029450%2C2029458%2C2029462%2C2029468%2C2029472%2C2029690%2C2029707%2C2029708%2C2029728%2C2029802%2C2029896%2C2029906%2C2030106%2C2030118%2C2030123%2C2030135%2C2030230%2C2030320 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1935995%2C1999158%2C2015952%2C2021909%2C2022026%2C2022041%2C2022088%2C2022276%2C2022335%2C2022338%2C2022373%2C2022597%2C2022874%2C2023276%2C2023544%2C2023551%2C2023599%2C2023608%2C2023814%2C2024233%2C2024239%2C2024241%2C2024242%2C2024250%2C2024251%2C2024343%2C2024422%2C2024425%2C2024440%2C2024442%2C2024446%2C2024458%2C2024463%2C2024478%2C2024650%2C2024653%2C2024654%2C2024655%2C2024656%2C2024661%2C2024662%2C2024668%2C2024919%2C2025278%2C2025349%2C2025350%2C2025354%2C2025360%2C2025363%2C2025370%2C2025379%2C2025381%2C2025399%2C2025400%2C2025403%2C2025407%2C2025415%2C2025420%2C2025427%2C2025429%2C2025430%2C2025479%2C2025489%2C2025493%2C2025497%2C2025502%2C2025515%2C2025517%2C2025526%2C2025609%2C2025948%2C2025949%2C2025951%2C2025953%2C2025955%2C2025962%2C2025969%2C2025970%2C2025971%2C2025973%2C2025976%2C2025977%2C2026280%2C2026285%2C2026293%2C2026296%2C2026310%2C2027237%2C2027260%2C2027268%2C2027277%2C2027284%2C2027291%2C2027293%2C2027298%2C2027330%2C2027342%2C2027345%2C2027359%2C2027365%2C2027378%2C2027754%2C2027959%2C2027962%2C2027964%2C2027971%2C2027974%2C2027979%2C2027982%2C2027995%2C2028001%2C2028267%2C2028268%2C2028275%2C2028288%2C2028290%2C2028291%2C2028528%2C2028551%2C2028627%2C2028879%2C2028889%2C2029061%2C2029071%2C2029283%2C2029296%2C2029314%2C2029323%2C2029411%2C2029423%2C2029424%2C2029425%2C2029427%2C2029436%2C2029440%2C2029449%2C2029450%2C2029458%2C2029462%2C2029468%2C2029472%2C2029690%2C2029707%2C2029708%2C2029728%2C2029802%2C2029896%2C2029906%2C2030106%2C2030118%2C2030123%2C2030135%2C2030230%2C2030320">
	<p>
	Memory safety bugs. Some of these bugs showed evidence of
	memory corruption and we presume that with enough effort
	some of these could have been exploited to run arbitrary
	code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6785</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6785</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="6881ae01-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=1536243%2C1745382%2C1851073%2C1893400%2C1963301%2C2001319%2C2002899%2C2012436%2C2014435%2C2016901%2C2019916%2C2020486%2C2020612%2C2020817%2C2021788%2C2022051%2C2022367%2C2022431%2C2023302%2C2023670%2C2024225%2C2024238%2C2024240%2C2024265%2C2024367%2C2024369%2C2024424%2C2024760%2C2025281%2C2025361%2C2025387%2C2025466%2C2025954%2C2025958%2C2026278%2C2026292%2C2026297%2C2026378%2C2027148%2C2027287%2C2027341%2C2027384%2C2027427%2C2027694%2C2027993%2C2028009%2C2028270%2C2028416%2C2028524%2C2029295%2C2029301%2C2029461%2C2029699%2C2029800%2C2029801 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=1536243%2C1745382%2C1851073%2C1893400%2C1963301%2C2001319%2C2002899%2C2012436%2C2014435%2C2016901%2C2019916%2C2020486%2C2020612%2C2020817%2C2021788%2C2022051%2C2022367%2C2022431%2C2023302%2C2023670%2C2024225%2C2024238%2C2024240%2C2024265%2C2024367%2C2024369%2C2024424%2C2024760%2C2025281%2C2025361%2C2025387%2C2025466%2C2025954%2C2025958%2C2026278%2C2026292%2C2026297%2C2026378%2C2027148%2C2027287%2C2027341%2C2027384%2C2027427%2C2027694%2C2027993%2C2028009%2C2028270%2C2028416%2C2028524%2C2029295%2C2029301%2C2029461%2C2029699%2C2029800%2C2029801">
	<p>
	Memory safety bugs. Some of these bugs showed evidence of
	memory corruption and we presume that with enough effort
	some of these could have been exploited to run arbitrary
	code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6784</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6784</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="65858bef-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions, integer overflow in the Audio/Video: Playback component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2027564 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2027564">
	<p>
	Incorrect boundary conditions, integer overflow in the
	Audio/Video: Playback component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6783</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6783</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="62053c0f-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Information disclosure in the IP Protection component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2026571 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2026571">
	  <p>Information disclosure in the IP Protection component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6782</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6782</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="5f2386b6-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Denial-of-service</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2025583 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2025583">
	  <p>Denial-of-service in the Audio/Video: Playback component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6781</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6781</url>
      <cvename>CVE-2026-6780</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6780</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="58a378c8-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Other issue in the JavaScript Engine component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2023343 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2023343">
	  <p>Other issue in the JavaScript Engine component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6779</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6779</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="5124ce36-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Invalid pointer</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022746 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022746">
	  <p>Invalid pointer in the Audio/Video: Playback component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6778</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6778</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="4ca48006-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Other issue in the Networking: DNS component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022726 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022726">
	  <p>Other issue in the Networking: DNS component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6777</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6777</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="48003ad3-430a-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2021770 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2021770">
	<p>
	Incorrect boundary conditions in the WebRTC: Networking
	component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6776</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6776</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="27c3930a-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions in the WebRTC component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2021768 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2021768">
	  <p>Incorrect boundary conditions in the WebRTC component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6775</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6775</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="2510f10a-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Mitigation bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2016915 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2016915">
	  <p>Mitigation bypass in the DOM: Security component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6774</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6774</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="2239d66b-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Denial-of-service</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2015959 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2015959">
	<p>
	Denial-of-service due to integer overflow in the Graphics:
	WebGPU component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6773</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6773</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="1fc576a4-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2026089 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2026089">
	<p>
	Incorrect boundary conditions in the Libraries component
	in NSS.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6772</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6772</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="1d3f0d87-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Mitigation bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2025067 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2025067">
	  <p>Mitigation bypass in the DOM: Security component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6771</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6771</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="1a442c0b-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Other issue in the Storage: IndexedDB component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2024220 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2024220">
	  <p>Other issue in the Storage: IndexedDB component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6770</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6770</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="177a7146-4307-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Privilege escalation in the Debugger component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2023753 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2023753">
	  <p>Privilege escalation in the Debugger component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6769</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6769</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="872a6e95-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Mitigation bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2023615 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2023615">
	  <p>Mitigation bypass in the Networking: Cookies component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6768</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6768</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="82451a4b-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Other issue in the Libraries component in NSS</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2023209 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2023209">
	  <p>Other issue in the Libraries component in NSS.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6767</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6767</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="7ff13e75-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2023207 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2023207">
	<p>
	Incorrect boundary conditions in the Libraries component
	in NSS.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6766</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6766</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="7da0d8ae-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Information disclosure</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022419 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022419">
	  <p>Information disclosure in the Form Autofill component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6765</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6765</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="7ae808b5-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022162 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022162">
	<p>
	Incorrect boundary conditions in the DOM: Device Interfaces
	component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6764</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6764</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="785dfce9-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Mitigation bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2021666 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2021666">
	  <p>Mitigation bypass in the File Handling component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6763</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6763</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="75b1251d-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Spoofing issue</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2021080 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2021080">
	  <p>Spoofing issue in the DOM: Core &amp; HTML component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6762</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6762</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="73091a42-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Privilege escalation</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2017857 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2017857">
	  <p>Privilege escalation in the Networking component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6761</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6761</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="6f7989ef-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Mitigation bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2016923 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2016923">
	  <p>Mitigation bypass in the Networking: Cookies component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6760</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6760</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="6cc5536b-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Use-after-free</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2016164 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2016164">
	  <p>Use-after-free in the Widget: Cocoa component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6759</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6759</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="6a439169-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Use-after-free</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2013619 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2013619">
	  <p>Use-after-free in the JavaScript: WebAssembly component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6758</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6758</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="671af4b2-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Invalid pointer</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2013588 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2013588">
	  <p>Invalid pointer in the JavaScript: WebAssembly component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6757</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6757</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="61805c9e-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Mitigation bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=1880429 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=1880429">
	  <p>Mitigation bypass in the DOM: postMessage component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6755</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6755</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="5ef5236d-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Use-after-free</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2027541 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2027541">
	  <p>Use-after-free in the JavaScript Engine component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6754</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6754</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="5b679594-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2027501 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2027501">
	  <p>Incorrect boundary conditions in the WebRTC component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6753</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6753</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="58b5fb4b-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2027499 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2027499">
	  <p>Incorrect boundary conditions in the WebRTC component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6752</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6752</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="56443cff-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Uninitialized memory</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2025883 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2025883">
	<p>
	Uninitialized memory in the Audio/Video: Web Codecs component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6751</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6751</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="537b8679-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Privilege escalation</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2023407 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2023407">
	  <p>Privilege escalation in the Graphics: WebRender component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6750</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6750</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="50ba4596-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Information disclosure</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022610 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022610">
	<p>
	Information disclosure due to uninitialized memory in the
	Graphics: Canvas2D component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6749</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6749</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="4dcdba00-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Uninitialized memory</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022604 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022604">
	<p>
	Uninitialized memory in the Audio/Video: Web Codecs
	component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6748</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6748</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="4ac6c6b3-4305-11f1-a627-b42e991fc52e">
    <topic>Mozilla -- Use-after-free</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2021769 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2021769">
	  <p>Use-after-free in the WebRTC component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6747</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6747</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="444cbf60-4305-11f1-a627-b42e991fc52e">
    <topic>firefox -- Use-after-free</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>150.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.10.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>150.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2014596 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2014596">
	  <p>Use-after-free in the DOM: Core &amp; HTML component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6746</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-6746</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-28</entry>
    </dates>
  </vuln>

  <vuln vid="dea605e6-41c9-11f1-8455-901b0e13f1a0">
    <topic>libXpm -- Out-of-bounds read in xpmNextWord()</topic>
    <affects>
    <package>
	<name>libXpm</name>
	<range><lt>3.5.19</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The X.Org project reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2026-April/003690.html">
	  <p>
	    libXpm uses a number of internal helper functions to parse the XPM
	    file format.
	    One of these internal functions, xpmNextString(), checks for the
	    NULL terminator when looking for the end of the current string but
	    not when looking for the beginning of the next string.
	    A small XPM file with a malformed color table definition may cause
	    the function xpmNextWord(), called from xpmParseColors() following
	    a call to xpmNextString(), to start past the actual end of the file,
	    causing an out-of-bound read.
	  </p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-4367</cvename>
      <url>https://lists.x.org/archives/xorg-announce/2026-April/003690.html</url>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-27</entry>
    </dates>
  </vuln>

  <vuln vid="88440f1d-4168-11f1-95f7-00a098b42aeb">
    <topic>(lib)expat -- Insufficient entropy</topic>
    <affects>
    <package>
	<name>expat</name>
	<range><lt>2.8.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/libexpat/libexpat/pull/1183 reports:</p>
	<blockquote cite="https://github.com/libexpat/libexpat/pull/1183">
	  <p>libexpat before 2.8.0 uses insufficient entropy, and thus hash
	  flooding can occur via a crafted XML document.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-41080</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-41080</url>
    </references>
    <dates>
      <discovery>2026-04-16</discovery>
      <entry>2026-04-26</entry>
    </dates>
  </vuln>

  <vuln vid="ca62e49c-4150-11f1-95f7-00a098b42aeb">
    <topic>lcms2 -- Integer overflow</topic>
    <affects>
    <package>
	<name>lcms2</name>
	<range><lt>2.19</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0 reports:</p>
	<blockquote cite="https://github.com/mm2/Little-CMS/commit/da6110b1d14abc394633a388209abd5ebedd7ab0">
	  <p>Little CMS (lcms2) through 2.18 has an integer overflow in
	  CubeSize in cmslut.c because the overflow check is performed after
	  the multiplication.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-41254</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-41254</url>
    </references>
    <dates>
      <discovery>2026-04-18</discovery>
      <entry>2026-04-26</entry>
    </dates>
  </vuln>

  <vuln vid="73b927a6-3ecd-11f1-be20-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.11.0</ge><lt>18.11.1</lt></range>
<range><ge>18.10.0</ge><lt>18.10.4</lt></range>
<range><ge>9.2.0</ge><lt>18.9.6</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-1-released/">
	  <p>Cross-Site Request Forgery issue in GraphQL API impacts GitLab CE/EE GitLab</p>
	  <p>Improper Resolution of Path Equivalence issue in Web IDE asset impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in Storybook impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in discussions endpoint impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Jira import impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in notes endpoint impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in GraphQL API impacts GitLab CE/EE</p>
	  <p>Insufficient Session Expiration issue in virtual registry credentials validation impacts GitLab CE/E</p>
	  <p>Improper Access Control issue in issue description renderer impacts GitLab CE/EE</p>
	  <p>Improper Restriction of Rendered UI Layers or Frames issue in Mermaid sandbox impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in project fork relationship API impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-4922</cvename>
      <cvename>CVE-2026-5816</cvename>
      <cvename>CVE-2026-5262</cvename>
      <cvename>CVE-2025-0186</cvename>
      <cvename>CVE-2026-1660</cvename>
      <cvename>CVE-2025-6016</cvename>
      <cvename>CVE-2025-3922</cvename>
      <cvename>CVE-2026-6515</cvename>
      <cvename>CVE-2026-5377</cvename>
      <cvename>CVE-2026-3254</cvename>
      <cvename>CVE-2025-9957</cvename>
      <url>https://docs.gitlab.com/releases/patches/patch-release-gitlab-18-11-1-released/</url>
    </references>
    <dates>
      <discovery>2026-04-22</discovery>
      <entry>2026-04-23</entry>
    </dates>
  </vuln>

  <vuln vid="549313db-3e93-11f1-8d38-7fbbe0285610">
    <topic>OpenVPN -- server DOS and data leak in TLS handshake vulnerabilities</topic>
    <affects>
      <package>
	<name>openvpn</name>
	<range><ge>2.7.0</ge><lt>2.7.2</lt></range>
	<range><lt>2.6.20</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gert Doering reports:</p>
	<blockquote cite="https://github.com/OpenVPN/openvpn/blob/v2.7.2/Changes.rst">
	  <p>[Security fixes in 2.7.2]</p>
	  <ul>
	    <li>fix race condition in TLS handshake that could lead to leaking of packet data from a previous handshake under specific circumstances (CVE-2026-40215)</li>
	    <li>fix server [termination] on receiving a suitably malformed packet with a valid tls-crypt-v2 key (CVE-2026-35058)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-35058</cvename>
      <cvename>CVE-2026-40215</cvename>
      <url>https://github.com/OpenVPN/openvpn/blob/v2.7.2/Changes.rst</url>
    </references>
    <dates>
      <discovery>2026-04-19</discovery>
      <entry>2026-04-22</entry>
      <modified>2026-05-02</modified>
    </dates>
  </vuln>

  <vuln vid="128951d0-3df0-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Missing large page handling in pmap_pkru_update_range()</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_6</lt></range>
	<range><ge>14.4</ge><lt>14.4_2</lt></range>
	<range><ge>14.3</ge><lt>14.3_11</lt></range>
	<range><ge>13.5</ge><lt>13.5_12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>In order to apply a particular protection key to an address
	  range, the kernel must update the corresponding page table entries.
	  The subroutine which handled this failed to take into account the
	  presence of 1GB largepage mappings created using the
	  shm_create_largepage(3) interface.  In particular, it would always
	  treat a page directory page entry as pointing to another page table
	  page.</p>
	<h1>Impact:</h1>
	  <p>The bug can be abused by an unprivileged user to cause
	  pmap_pkru_update_range() to treat userspace memory as a page table
	  page, and thus overwrite memory to which the application would
	  otherwise not have access.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-6386</cvename>
      <freebsdsa>SA-26:11.amd64</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="971b5528-3def-11f1-bb07-bc241121aa0a">
    <topic>FreeBSD -- Kernel use-after-free bug in the TIOCNOTTY handler</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_6</lt></range>
	<range><ge>14.4</ge><lt>14.4_2</lt></range>
	<range><ge>14.3</ge><lt>14.3_11</lt></range>
	<range><ge>13.5</ge><lt>13.5_12</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>The implementation of TIOCNOTTY failed to clear a back-pointer
	  from the structure representing the controlling terminal to the
	  calling process' session.  If the invoking process then exits, the
	  terminal structure may end up containing a pointer to freed memory.</p>
	<h1>Impact:</h1>
	  <p>A malicious process can abuse the dangling pointer to grant
	  itself root privileges.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-5398</cvename>
      <freebsdsa>SA-26:10.tty</freebsdsa>
    </references>
    <dates>
      <discovery>2026-04-21</discovery>
      <entry>2026-04-22</entry>
    </dates>
  </vuln>

  <vuln vid="c4972d4f-3d93-11f1-9073-b42e991fc52e">
    <topic>Mozilla -- Integer overflow</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>148.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.8.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>148.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2009552 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2009552">
	  <p>Integer overflow in the Libraries component in NSS.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-2781</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-2781</url>
    </references>
    <dates>
      <discovery>2026-02-24</discovery>
      <entry>2026-04-21</entry>
    </dates>
  </vuln>

  <vuln vid="82064ab5-3d76-11f1-89ab-901b0e9408dc">
    <topic>ejabberd -- Potential DDoS in XML Parser</topic>
    <affects>
<package>
<name>ejabberd</name>
<range><lt>26.04</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>ejabberd team reports:</p>
	<blockquote cite="https://www.process-one.net/blog/ejabberd-26-04/">
	  <p>This release adds new options that limit max memory used
	  by XML parser used to process XMPP payloads, to prevent
	  potential Denial of Service attack. The default values for
	  pre-auth provide sufficient protection for ejabberd against
	  non-authenticated users on c2s and s2s, so there is no need
	  to change your configuration.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://www.process-one.net/blog/ejabberd-26-04/</url>
    </references>
    <dates>
      <discovery>2026-04-20</discovery>
      <entry>2026-04-21</entry>
    </dates>
  </vuln>

  <vuln vid="0d8b1126-0864-4934-b63f-c713526ead32">
    <topic>zeek -- potential DoS vulnerabilities</topic>
    <affects>
<package>
<name>zeek</name>
<range><lt>8.0.7</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Wojtulewicz of Corelight reports:</p>
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v8.0.7">
	  <p>A series of DNS messages containing long DNS compression
	  chains can cause Zeek to spend a long time processing
	  packets and potentially crash. Due to the fact that these
	  packets can be received from remote hosts, this is a DoS
	  risk. </p>
	  <p>A specially-crafted LDAP search request can cause Zeek
	  to spend a long time processing the packet, resulting in
	  Zeek silently dropping the LDAP analyzer for the connection.
	  Due to the fact that these packets can be received from
	  remote hosts, this is an evasion risk. </p>
	  <p>A specially-crafted series of ASN.1 messages in LDAP
	  packets can cause Zeek to spend a long time processing
	  the packets, resulting in Zeek silently dropping the LDAP
	  analyzer for the connection.  Due to the fact that these
	  packets can be received from remote hosts, this is an
	  evasion risk. </p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/zeek/zeek/releases/tag/v8.0.7</url>
    </references>
    <dates>
      <discovery>2026-04-20</discovery>
      <entry>2026-04-20</entry>
    </dates>
  </vuln>

  <vuln vid="7b83af27-3a86-11f1-90cd-41d47652b1c2">
    <topic>OpenEXR -- several integer overflow vulnerabilities</topic>
    <affects>
	<package>
	    <name>openexr</name>
	    <range><lt>3.4.10</lt></range>
	</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cary Phillips reports:</p>
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.3.10">
	    <p>OpenEXR 3.4.10 is a patch release that addresses the following security vulnerabilities:</p>
	    <ul><li>CVE-2026-39886 HTJ2K Signed Integer Overflow in ht_undo_impl()</li>
		<li>CVE-2026-40244 Integer overflow in DWA setupChannelData planarUncRle pointer arithmetic (missed variant of CVE-2026-34589)</li>
		<li>CVE-2026-40250 Integer overflow in DWA decoder outBufferEnd pointer arithmetic (missed variant of CVE-2026-34589)</li></ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-39886</cvename>
      <cvename>CVE-2026-40244</cvename>
      <cvename>CVE-2026-40250</cvename>
      <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.10</url>
    </references>
    <dates>
      <discovery>2026-04-17</discovery>
      <entry>2026-04-19</entry>
    </dates>
  </vuln>

  <vuln vid="6f1c19bf-3b29-11f1-930b-98b78501ef2a">
    <topic>xrdp -- Multiple vulnerabilities</topic>
    <affects>
    <package>
      <name>xrdp</name>
      <range><lt>0.10.6,1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>xrdp project reports:</p>
	<blockquote cite="https://github.com/neutrinolabs/xrdp/releases/tag/v0.10.6">
	  <p>This release includes 8 security fixes:</p>
	  <ul>
	    <li>CVE-2026-32105</li>
	    <li>CVE-2026-32107</li>
	    <li>CVE-2026-32623</li>
	    <li>CVE-2026-32624</li>
	    <li>CVE-2026-33145</li>
	    <li>CVE-2026-32516</li>
	    <li>CVE-2026-32689</li>
	    <li>CVE-2026-35512</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-32105</cvename>
      <cvename>CVE-2026-32107</cvename>
      <cvename>CVE-2026-32623</cvename>
      <cvename>CVE-2026-32624</cvename>
      <cvename>CVE-2026-33145</cvename>
      <cvename>CVE-2026-32516</cvename>
      <cvename>CVE-2026-32689</cvename>
      <cvename>CVE-2026-35512</cvename>
    </references>
    <dates>
      <discovery>2026-03-03</discovery>
      <entry>2026-04-18</entry>
    </dates>
  </vuln>

  <vuln vid="6a0aa20d-399f-11f1-8626-901b0edee044">
    <topic>py-strawberry-graphql -- Multiple vulnerabilities</topic>
    <affects>
    <package>
	<name>py310-strawberry-graphql</name>
	<name>py311-strawberry-graphql</name>
	<name>py312-strawberry-graphql</name>
	<name>py313-strawberry-graphql</name>
	<name>py313t-strawberry-graphql</name>
	<name>py314-strawberry-graphql</name>
	<range><lt>0.312.3</lt></range>
    </package>
    <package>
	<name>py310-dj52-strawberry-graphql</name>
	<name>py311-dj52-strawberry-graphql</name>
	<name>py312-dj52-strawberry-graphql</name>
	<name>py313-dj52-strawberry-graphql</name>
	<name>py313t-dj52-strawberry-graphql</name>
	<name>py314-dj52-strawberry-graphql</name>
	<range><lt>0.312.3</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Strawberry GraphQL project reports:</p>
	<blockquote cite="https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-vpwc-v33q-mq89">
	<p>Strawberry up until version 0.312.3 is vulnerable to an authentication bypass
	on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler
	does not verify that a 'connection_init' handshake has been completed before
	processing start (subscription) messages. This allows a remote attacker to skip
	the 'on_ws_connect' authentication hook entirely by connecting with the
	graphql-ws subprotocol and sending a start message directly, without ever
	sending 'connection_init'.

	The graphql-transport-ws subprotocol handler is not affected, as it correctly
	gates subscription operations on a connection_acknowledged flag. However, both
	subprotocols are enabled by default in all framework integrations that support
	websockets, and the subprotocol is selected by the client via the
	Sec-WebSocket-Protocol header.

	Any application relying on 'on_ws_connect' for authentication or authorization
	is affected.</p>
	</blockquote>
	<blockquote cite="https://github.com/strawberry-graphql/strawberry/security/advisories/GHSA-hv3w-m4g2-5x77">
	<p>Strawberry GraphQL's WebSocket subscription handlers for both the
	'graphql-transport-ws' and legacy 'graphql-ws' protocols allocate an
	asyncio.Task and associated Operation object for every incoming subscribe
	message without enforcing any limit on the number of active subscriptions per
	connection.

	An unauthenticated attacker can open a single WebSocket connection, send
	connection_init, and then flood subscribe messages with unique IDs. Each
	message unconditionally spawns a new 'asyncio.Task' and async generator,
	causing linear memory growth and event loop saturation. This leads to server
	degradation or an OOM crash.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-35523</cvename>
      <url>https://www.cve.org/CVERecord?id=CVE-2026-35523</url>
      <cvename>CVE-2026-35526</cvename>
      <url>https://www.cve.org/CVERecord?id=CVE-2026-35526</url>
    </references>
    <dates>
      <discovery>2026-04-04</discovery>
      <entry>2026-04-17</entry>
    </dates>
  </vuln>

  <vuln vid="6ae8f9e5-3a26-11f1-b60b-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>149.0.2,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.9.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>149.0.2</lt></range>
    </package>
    <package>
	<name>thunderbird-esr</name>
	<range><lt>140.9.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mozilla reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2021894%2C2022225%2C2022252%2C2022294%2C2023007%2C2023130%2C2023191%2C2023364%2C2023829%2C2024074%2C2024417%2C2024433%2C2024436%2C2024437%2C2024453%2C2024461%2C2024462%2C2024472%2C2024474%2C2024477%2C2025364%2C2025401%2C2025402%2C2025472%2C2026287%2C2026299%2C2026305%2C2026426">
	<p>
	Memory safety bugs present in Firefox ESR, Firefox ESR ,
	Thunderbird ESR, and Thunderbird. Some of these bugs
	showed evidence of memory corruption and we presume that
	with enough effort some of these could have been exploited
	  to run arbitrary code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5731</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-5731</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-17</entry>
    </dates>
  </vuln>

  <vuln vid="9c8c00ce-3642-11f1-bd03-3c7c3fba4204">
    <topic>go-ethereum -- vulnerabilities</topic>
    <affects>
    <package>
	<name>go-ethereum</name>
	<range><lt>1.17.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/ethereum/go-ethereum/security/advisories reports:</p>
	<blockquote cite="https://github.com/ethereum/go-ethereum/security/advisories">
	  <ul>
	    <li>DoS via malicious p2p message (CVE-2026-26313)</li>
	    <li>DoS via malicious p2p message (CVE-2026-26314)</li>
	    <li>Improper ECIES Public Key Validation in RLPx Handshake (CVE-2026-26315)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-26313</cvename>
      <url>https://github.com/ethereum/go-ethereum/security/advisories/GHSA-689v-6xwf-5jf3</url>
      <cvename>CVE-2026-26314</cvename>
      <url>https://github.com/ethereum/go-ethereum/security/advisories/GHSA-2gjw-fg97-vg3r</url>
      <cvename>CVE-2026-26315</cvename>
      <url>https://github.com/ethereum/go-ethereum/security/advisories/GHSA-m6j8-rg6r-7mv8</url>
    </references>
    <dates>
      <discovery>2026-02-17</discovery>
      <entry>2026-04-12</entry>
    </dates>
  </vuln>

  <vuln vid="d93c247b-4dba-43ce-b5c0-ac5bd03bea8d">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>147.0.7727.101</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>147.0.7727.101</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html">
	 <p>This update includes 31 security fixes:</p>
	 <ul>
	    <li>[490170083] Critical CVE-2026-6296: Heap buffer overflow in ANGLE. Reported by cinzinga on 2026-03-05</li>
	    <li>[493628982] Critical CVE-2026-6297: Use after free in Proxy. Reported by heapracer on 2026-03-17</li>
	    <li>[495700484] Critical CVE-2026-6298: Heap buffer overflow in Skia. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-24</li>
	    <li>[497053588] Critical CVE-2026-6299: Use after free in Prerender. Reported by Google on 2026-03-28</li>
	    <li>[497724498] Critical CVE-2026-6358: Use after free in XR. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-03-30</li>
	    <li>[490251701] High CVE-2026-6359: Use after free in Video. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-06</li>
	    <li>[491994185] High CVE-2026-6300: Use after free in CSS. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-12</li>
	    <li>[495273999] High CVE-2026-6301: Type Confusion in Turbofan. Reported by qymag1c on 2026-03-23</li>
	    <li>[495477995] High CVE-2026-6302: Use after free in Video. Reported by Syn4pse on 2026-03-24</li>
	    <li>[496282147] High CVE-2026-6303: Use after free in Codecs. Reported by Google on 2026-03-25</li>
	    <li>[496393742] High CVE-2026-6304: Use after free in Graphite. Reported by Google on 2026-03-26</li>
	    <li>[496618639] High CVE-2026-6305: Heap buffer overflow in PDFium. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-26</li>
	    <li>[496907110] High CVE-2026-6306: Heap buffer overflow in PDFium. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-27</li>
	    <li>[497404188] High CVE-2026-6307: Type Confusion in Turbofan. Reported by Project WhatForLunch (@pjwhatforlunch) on 2026-03-29</li>
	    <li>[497412658] High CVE-2026-6308: Out of bounds read in Media. Reported by Google on 2026-03-29</li>
	    <li>[497846428] High CVE-2026-6309: Use after free in Viz. Reported by Google on 2026-03-30</li>
	    <li>[497880137] High CVE-2026-6360: Use after free in FileSystem. Reported by asjidkalam on 2026-03-31</li>
	    <li>[497969820] High CVE-2026-6310: Use after free in Dawn. Reported by Google on 2026-03-31</li>
	    <li>[498201025] High CVE-2026-6311: Uninitialized Use in Accessibility. Reported by Google on 2026-03-31</li>
	    <li>[498269651] High CVE-2026-6312: Insufficient policy enforcement in Passwords. Reported by Google on 2026-03-31</li>
	    <li>[498765210] High CVE-2026-6313: Insufficient policy enforcement in CORS. Reported by Google on 2026-04-02</li>
	    <li>[498782145] High CVE-2026-6314: Out of bounds write in GPU. Reported by Google on 2026-04-02</li>
	    <li>[499247910] High CVE-2026-6315: Use after free in Permissions. Reported by Google on 2026-04-03</li>
	    <li>[499384399] High CVE-2026-6316: Use after free in Forms. Reported by Google on 2026-04-03</li>
	    <li>[500036290] High CVE-2026-6361: Heap buffer overflow in PDFium. Reported by Google on 2026-04-06</li>
	    <li>[500066234] High CVE-2026-6362: Use after free in Codecs. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-04-07</li>
	    <li>[500091052] High CVE-2026-6317: Use after free in Cast. Reported by Google on 2026-04-06</li>
	    <li>[495751197] Medium CVE-2026-6363: Type Confusion in V8. Reported by Google on 2026-03-24</li>
	    <li>[495996858] Medium CVE-2026-6318: Use after free in Codecs. Reported by Syn4pse on 2026-03-25</li>
	    <li>[499018889] Medium CVE-2026-6319: Use after free in Payments. Reported by pwn2addr on 2026-04-02</li>
	    <li>[502103414] Medium CVE-2026-6364: Out of bounds read in Skia. Reported by Google Threat Intelligence on 2026-04-13</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-6296</cvename>
      <cvename>CVE-2026-6297</cvename>
      <cvename>CVE-2026-6298</cvename>
      <cvename>CVE-2026-6299</cvename>
      <cvename>CVE-2026-6358</cvename>
      <cvename>CVE-2026-6359</cvename>
      <cvename>CVE-2026-6300</cvename>
      <cvename>CVE-2026-6301</cvename>
      <cvename>CVE-2026-6302</cvename>
      <cvename>CVE-2026-6303</cvename>
      <cvename>CVE-2026-6304</cvename>
      <cvename>CVE-2026-6305</cvename>
      <cvename>CVE-2026-6306</cvename>
      <cvename>CVE-2026-6307</cvename>
      <cvename>CVE-2026-6308</cvename>
      <cvename>CVE-2026-6309</cvename>
      <cvename>CVE-2026-6360</cvename>
      <cvename>CVE-2026-6310</cvename>
      <cvename>CVE-2026-6311</cvename>
      <cvename>CVE-2026-6312</cvename>
      <cvename>CVE-2026-6313</cvename>
      <cvename>CVE-2026-6314</cvename>
      <cvename>CVE-2026-6315</cvename>
      <cvename>CVE-2026-6316</cvename>
      <cvename>CVE-2026-6361</cvename>
      <cvename>CVE-2026-6362</cvename>
      <cvename>CVE-2026-6317</cvename>
      <cvename>CVE-2026-6363</cvename>
      <cvename>CVE-2026-6318</cvename>
      <cvename>CVE-2026-6319</cvename>
      <cvename>CVE-2026-6364</cvename>
      <url>https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html</url>
    </references>
    <dates>
      <discovery>2026-04-15</discovery>
      <entry>2026-04-16</entry>
    </dates>
  </vuln>

  <vuln vid="7a7a17b2-381c-11f1-a663-10ffe07f9334">
    <topic>PHP Composer -- Multiple vulnerabilities</topic>
    <affects>
<package>
<name>php82-composer</name>
<name>php83-composer</name>
<name>php84-composer</name>
<name>php85-composer</name>
<range><lt>2.9.6</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Composer project reports:</p>
	<blockquote cite="https://github.com/composer/composer/releases/tag/2.9.6">
	  <p>Fixed command injection via malicious Perforce reference (GHSA-gqw4-4w2p-838q / CVE-2026-40261)</p>
    <p>Fixed command injection via malicious Perforce repository definition (GHSA-wg36-wvj6-r67p / CVE-2026-40176)</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-40261</cvename>
      <cvename>CVE-2026-40176</cvename>
      <url>https://github.com/composer/composer/releases/tag/2.9.6</url>
    </references>
    <dates>
      <discovery>2026-04-14</discovery>
      <entry>2026-04-14</entry>
    </dates>
  </vuln>

  <vuln vid="099423d1-3815-11f1-a284-589cfc10a551">
    <topic>xwayland -- Multiple vulnerabilities</topic>
    <affects>
<package>
<name>xwayland</name>
<range><lt>24.1.10</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>X.Org project reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2026-April/003677.html">
	  <p>Multiple issues have been found in the X server and Xwayland
	     implementations published by X.Org for which we are releasing
	     security fixes for in xorg-server-21.1.22 and xwayland-24.1.10.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-33999</cvename>
      <cvename>CVE-2026-34000</cvename>
      <cvename>CVE-2026-34001</cvename>
      <cvename>CVE-2026-34002</cvename>
      <cvename>CVE-2026-34003</cvename>
      <url>https://lists.x.org/archives/xorg-announce/2026-April/003677.html</url>
    </references>
    <dates>
      <discovery>2026-04-14</discovery>
      <entry>2026-04-14</entry>
    </dates>
  </vuln>

  <vuln vid="7b6463c6-3813-11f1-a284-589cfc10a551">
    <topic>xorg-server -- Multiple vulnerabilities</topic>
    <affects>
<package>
<name>xorg-server</name>
<range><lt>21.1.22</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>X.Org project reports:</p>
	<blockquote cite="https://lists.x.org/archives/xorg-announce/2026-April/003677.html">
	  <p>Multiple issues have been found in the X server and Xwayland
	     implementations published by X.Org for which we are releasing
	     security fixes for in xorg-server-21.1.22 and xwayland-24.1.10.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-33999</cvename>
      <cvename>CVE-2026-34000</cvename>
      <cvename>CVE-2026-34001</cvename>
      <cvename>CVE-2026-34002</cvename>
      <cvename>CVE-2026-34003</cvename>
      <url>https://lists.x.org/archives/xorg-announce/2026-April/003677.html</url>
    </references>
    <dates>
      <discovery>2026-04-14</discovery>
      <entry>2026-04-14</entry>
    </dates>
  </vuln>

  <vuln vid="cf75f572-378a-11f1-a119-e36228bfe7d4">
    <topic>python -- more webbrowser.open() command injection vulnerabilities</topic>
    <affects>
      <package><name>python310</name><range><ge>0</ge></range></package>
      <package><name>python311</name><range><ge>0</ge></range></package>
      <package><name>python312</name><range><ge>0</ge></range></package>
      <package><name>python313</name><range><ge>0</ge></range></package>
      <package><name>python314</name><range><lt>3.14.4_2</lt></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Seth Larson reports:</p>
	<blockquote cite="https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/">
	  <p>[CVE-2026-4786] Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()</p>
	  <p>There is a HIGH severity vulnerability affecting CPython.</p>
	  <p>Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action"
	   the mitigation could be bypassed for certain browser types the
	   "webbrowser.open()" API could have commands injected into the underlying
	    shell. See CVE-2026-4519 for details.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-4786</cvename>
      <url>https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/</url>
      <url>https://www.cve.org/CVERecord?id=CVE-2026-4786</url>
      <url>https://github.com/python/cpython/issues/148169</url>
      <url>https://github.com/python/cpython/pull/148170</url>
    </references>
    <dates>
      <discovery>2026-04-06</discovery>
      <entry>2026-04-13</entry>
    </dates>
  </vuln>

  <vuln vid="b8e9f33c-375d-11f1-a119-e36228bfe7d4">
    <topic>Python -- use-after-free vulnerability in decompressors under memory pressure</topic>
    <affects>
      <package><name>python310</name><range><ge>0</ge></range></package>
      <package><name>python311</name><range><ge>0</ge></range></package>
      <package><name>python312</name><range><ge>0</ge></range></package>
      <package><name>python313</name><range><ge>0</ge></range></package>
      <package><name>python314</name><range><lt>3.14.4_1</lt></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Seth Larson reports:</p>
	<blockquote cite="https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/">
	  <p>There is a CRITICAL severity vulnerability affecting CPython.</p>
	  <p>Use-after-free (UAF) was possible in the lzma.LZMADecompressor,
	    bz2.BZ2Decompressor, and gzip.GzipFile when a memory allocation fails
	    with a MemoryError and the decompression instance is re-used. This
	    scenario can be triggered if the process is under memory pressure. The fix
	    cleans up the dangling pointer in this specific error condition.</p>
	  <p>The vulnerability is only present if the program re-uses decompressor
	    instances across multiple decompression calls even after a MemoryError is
	    raised during decompression. Using the helper functions to one-shot
	    decompress data such as lzma.decompress(), bz2.decompress(),
	    gzip.decompress(), and zlib.decompress() are not affected as a new
	    decompressor instance is created for each call. If the decompressor
	    instance is not re-used after an error condition, this usage is similarly
	    not vulnerable.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-6100</cvename>
      <url>https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/</url>
      <url>https://github.com/python/cpython/issues/148395</url>
    </references>
    <dates>
      <discovery>2026-04-11</discovery>
      <entry>2026-04-13</entry>
    </dates>
  </vuln>

  <vuln vid="57f31f61-36a1-11f1-9839-8447094a420f">
    <topic>Vaultwarden -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>vaultwarden</name>
	<range><lt>1.35.5</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Vaultwarden project reports:</p>
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5">
	  <p>GHSA-937x-3j8m-7w7p Unconfirmed Owner Can Purge Entire Organization Vault.</p>
	  <p>GHSA-569v-845w-g82p Cross-Org Group Binding Enables Unauthorized Read And Write Access Into Another Organization</p>
	  <p>GHSA-6j4w-g4jh-xjfx Refresh tokens not invalidated on security stamp rotation</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.5</url>
    </references>
    <dates>
      <discovery>2026-04-12</discovery>
      <entry>2026-04-12</entry>
    </dates>
  </vuln>

  <vuln vid="30bda1c3-369b-11f1-b51c-6dd25bec137b">
    <topic>Python -- HTTP proxy CONNECT tunnel does not sanitize CR/LF</topic>
    <affects>
      <package><name>python310</name><range><ge>0</ge></range></package>
      <package><name>python311</name><range><ge>0</ge></range></package>
      <package><name>python312</name><range><ge>0</ge></range></package>
      <package><name>python313</name><range><ge>0</ge></range></package>
      <package><name>python314</name><range><lt>3.14.4</lt></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Seth Larson reports:</p>
	<blockquote cite="https://github.com/python/cpython/issues/146211">
	  <p>HTTP proxy via "CONNECT" tunneling doesn't sanitize CR/LF (CVE-2026-1502).</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-1502</cvename>
      <url>https://github.com/python/cpython/issues/146211</url>
    </references>
    <dates>
      <discovery>2026-03-20</discovery>
      <entry>2026-04-12</entry>
    </dates>
   </vuln>

  <vuln vid="5ec4dcf6-3588-11f1-b51c-6dd25bec137b">
    <topic>Python -- configparser vulnerable to excessive CPU use</topic>
    <affects>
      <package><name>python310</name><range><ge>0</ge></range></package>
      <package><name>python311</name><range><ge>0</ge></range></package>
      <package><name>python312</name><range><ge>0</ge></range></package>
      <package><name>python313</name><range><ge>0</ge></range></package>
      <package><name>python314</name><range><lt>3.14.4</lt></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Stan Ulbrych reports:</p>
	<blockquote cite="https://github.com/python/cpython/issues/146333">
	  <p>configparser.RawConfigParser.{OPTCRE,OPTCRE_NV} regexes [are] vulnerable to quadratic backtracking.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/python/cpython/issues/146333</url>
    </references>
    <dates>
      <discovery>2026-03-23</discovery>
      <entry>2026-04-12</entry>
    </dates>
  </vuln>

  <vuln vid="8d549898-3598-11f1-a8bc-3c7c3fba4204">
    <topic>py-ormar -- vulnerabilities</topic>
    <affects>
    <package>
	<name>py310-ormar</name>
	<name>py311-ormar</name>
	<name>py312-ormar</name>
	<name>py313-ormar</name>
	<name>py313t-ormar</name>
	<name>py314-ormar</name>
	<range><lt>0.23.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/ormar-orm/ormar/security/advisories reports:</p>
	<blockquote cite="https://github.com/collerek/ormar/security/advisories">
	  <ul>
	    <li>SQL Injection in aggregate functions min() and max()</li>
	    <li>Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-26198</cvename>
      <url>https://github.com/ormar-orm/ormar/security/advisories/GHSA-xxh2-68g9-8jqr</url>
      <cvename>CVE-2026-27953</cvename>
      <url>https://github.com/ormar-orm/ormar/security/advisories/GHSA-f964-whrq-44h8</url>
    </references>
    <dates>
      <discovery>2026-02-22</discovery>
      <entry>2026-04-11</entry>
    </dates>
  </vuln>

  <vuln vid="766bb9b5-357f-11f1-98f0-00a098b42aeb">
    <topic>(lib)tiff -- Integer Overflow or Wraparound</topic>
    <affects>
    <package>
	<name>tiff</name>
	<range><lt>4.7.1_1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PrymEvol and Quang Luong reports:</p>
	<blockquote cite="https://www.cve.org/CVERecord?id=CVE-2026-4775">
	  <p>A flaw was found in the libtiff library.  A remote attacker could
	     exploit a signed integer overflow vulnerability in the
	     putcontig8bitYCbCr44tile function by providing a specially crafted
	     TIFF file.  This flaw can lead to an out-of-bounds heap write due
	     to incorrect memory pointer calculations, potentially causing a
	     denial of service (application crash) or arbitrary code execution.
	  </p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-4775</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-4775</url>
    </references>
    <dates>
      <discovery>2026-03-24</discovery>
      <entry>2026-04-11</entry>
    </dates>
  </vuln>

  <vuln vid="431c2753-3503-11f1-bc6d-3c7c3fba4204">
    <topic>DNSdist -- vulnerabilities</topic>
    <affects>
    <package>
	<name>dnsdist</name>
	<range><lt>2.0.3</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html reports:</p>
	<blockquote cite="https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html">
	  <ul>
	    <li>CVE-2026-0396: HTML injection in the web dashboard</li>
	    <li>CVE-2026-0397: Information disclosure via CORS misconfiguration</li>
	    <li>CVE-2026-24028: Out-of-bounds read when parsing DNS packets via Lua</li>
	    <li>CVE-2026-24029: DNS over HTTPS ACL bypass</li>
	    <li>CVE-2026-24030: Unbounded memory allocation for DoQ and DoH3</li>
	    <li>CVE-2026-27853: Out-of-bounds write when rewriting large DNS packets</li>
	    <li>CVE-2026-27854: Use after free when parsing EDNS options in Lua</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-0396</cvename>
      <cvename>CVE-2026-0397</cvename>
      <cvename>CVE-2026-24028</cvename>
      <cvename>CVE-2026-24029</cvename>
      <cvename>CVE-2026-24030</cvename>
      <cvename>CVE-2026-27853</cvename>
      <cvename>CVE-2026-27854</cvename>
      <url>https://www.dnsdist.org/security-advisories/powerdns-advisory-for-dnsdist-2026-02.html</url>
    </references>
    <dates>
      <discovery>2026-03-31</discovery>
      <entry>2026-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="d77bd2f5-34f0-11f1-bc6d-3c7c3fba4204">
    <topic>Mbed TLS -- vulnerabilities</topic>
    <affects>
    <package>
	<name>mbedtls3</name>
	<range><lt>3.6.6</lt></range>
    </package>
    <package>
	<name>mbedtls4</name>
	<range><lt>4.1.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://mbed-tls.readthedocs.io/en/latest/security-advisories/ reports:</p>
	<blockquote cite="https://mbed-tls.readthedocs.io/en/latest/security-advisories/">
	  <ul>
	    <li>Client impersonation while resuming a TLS 1.3 session (CVE-2026-34873)</li>
	    <li>Entropy on Linux can fall back to /dev/urandom (CVE-2026-34871)</li>
	    <li>PSA random generator cloning (CVE-2026-25835)</li>
	    <li>Compiler-induced constant-time violations (CVE-2025-66442)</li>
	    <li>Null pointer dereference when setting a distinguished name (CVE-2026-34874)</li>
	    <li>Buffer overflow in FFDH public key export (CVE-2026-34875)</li>
	    <li>FFDH: lack of contributory behaviour due to improper input validation (CVE-2026-34872)</li>
	    <li>Signature Algorithm Injection (CVE-2026-25834)</li>
	    <li>CCM multipart finish tag-length validation bypass (CVE-2026-34876)</li>
	    <li>Risk of insufficient protection of serialized session or context data leading to potential memory safety issues (CVE-2026-34877)</li>
	    <li>Buffer underflow in x509_inet_pton_ipv6() (CVE-2026-25833)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-34873</cvename>
      <cvename>CVE-2026-34871</cvename>
      <cvename>CVE-2026-25835</cvename>
      <cvename>CVE-2025-66442</cvename>
      <cvename>CVE-2026-34874</cvename>
      <cvename>CVE-2026-34875</cvename>
      <cvename>CVE-2026-34872</cvename>
      <cvename>CVE-2026-25834</cvename>
      <cvename>CVE-2026-34876</cvename>
      <cvename>CVE-2026-34877</cvename>
      <cvename>CVE-2026-25833</cvename>
      <url>https://mbed-tls.readthedocs.io/en/latest/security-advisories/</url>
    </references>
    <dates>
      <discovery>2026-03-31</discovery>
      <entry>2026-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="4b727a1a-5034-42b4-b29b-2289389f4ba8">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>147.0.7727.55</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>147.0.7727.55</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html">
	 <p>This update includes multiple security fixes:</p>
	 <p>Critical:</p>
	 <ul>
	    <li>CVE-2026-5858: Heap buffer overflow in WebML.</li>
	    <li>CVE-2026-5859: Integer overflow in WebML.</li>
	</ul>
	<p>High:</p>
	<ul>
	    <li>CVE-2026-5860: Use after free in WebRTC.</li>
	    <li>CVE-2026-5861: Use after free in V8.</li>
	    <li>CVE-2026-5862: Inappropriate implementation in V8.</li>
	    <li>CVE-2026-5863: Inappropriate implementation in V8.</li>
	    <li>CVE-2026-5864: Heap buffer overflow in WebAudio.</li>
	    <li>CVE-2026-5865: Type Confusion in V8.</li>
	    <li>CVE-2026-5866: Use after free in Media.</li>
	    <li>CVE-2026-5867: Heap buffer overflow in WebML.</li>
	    <li>CVE-2026-5868: Heap buffer overflow in ANGLE.</li>
	    <li>CVE-2026-5869: Heap buffer overflow in WebML.</li>
	    <li>CVE-2026-5870: Integer overflow in Skia.</li>
	    <li>CVE-2026-5871: Type Confusion in V8.</li>
	    <li>CVE-2026-5872: Use after free in Blink.</li>
	    <li>CVE-2026-5873: Out of bounds read and write in V8.</li>
	</ul>
	<p>Medium:</p>
	<ul>
	    <li>CVE-2026-5874: Use after free in PrivateAI.</li>
	    <li>CVE-2026-5875: Policy bypass in Blink.</li>
	    <li>CVE-2026-5876: Side-channel information leakage in Navigation.</li>
	    <li>CVE-2026-5877: Use after free in Navigation.</li>
	    <li>CVE-2026-5878: Incorrect security UI in Blink.</li>
	    <li>CVE-2026-5879: Insufficient validation of untrusted input in ANGLE.</li>
	    <li>CVE-2026-5880: Incorrect security UI in browser UI.</li>
	    <li>CVE-2026-5881: Policy bypass in LocalNetworkAccess.</li>
	    <li>CVE-2026-5882: Incorrect security UI in Fullscreen.</li>
	    <li>CVE-2026-5883: Use after free in Media.</li>
	    <li>CVE-2026-5884: Insufficient validation of untrusted input in Media.</li>
	    <li>CVE-2026-5885: Insufficient validation of untrusted input in WebML.</li>
	    <li>CVE-2026-5886: Out of bounds read in WebAudio.</li>
	    <li>CVE-2026-5887: Insufficient validation of untrusted input in Downloads.</li>
	    <li>CVE-2026-5888: Uninitialized Use in WebCodecs.</li>
	    <li>CVE-2026-5889: Cryptographic Flaw in PDFium.</li>
	    <li>CVE-2026-5890: Race in WebCodecs.</li>
	    <li>CVE-2026-5891: Insufficient policy enforcement in browser UI.</li>
	    <li>CVE-2026-5892: Insufficient policy enforcement in PWAs.</li>
	    <li>CVE-2026-5893: Race in V8.</li>
	</ul>
	<p>Low:</p>
	<ul>
	    <li>CVE-2026-5894: Inappropriate implementation in PDF.</li>
	    <li>CVE-2026-5895: Incorrect security UI in Omnibox.</li>
	    <li>CVE-2026-5896: Policy bypass in Audio.</li>
	    <li>CVE-2026-5897: Incorrect security UI in Downloads.</li>
	    <li>CVE-2026-5898: Incorrect security UI in Omnibox.</li>
	    <li>CVE-2026-5899: Incorrect security UI in History Navigation.</li>
	    <li>CVE-2026-5900: Policy bypass in Downloads.</li>
	    <li>CVE-2026-5901: Policy bypass in DevTools.</li>
	    <li>CVE-2026-5902: Race in Media.</li>
	    <li>CVE-2026-5903: Policy bypass in IFrameSandbox.</li>
	    <li>CVE-2026-5904: Use after free in V8.</li>
	    <li>CVE-2026-5905: Incorrect security UI in Permissions.</li>
	    <li>CVE-2026-5906: Incorrect security UI in Omnibox.</li>
	    <li>CVE-2026-5907: Insufficient data validation in Media.</li>
	    <li>CVE-2026-5908: Integer overflow in Media.</li>
	    <li>CVE-2026-5909: Integer overflow in Media.</li>
	    <li>CVE-2026-5910: Integer overflow in Media.</li>
	    <li>CVE-2026-5911: Policy bypass in ServiceWorkers.</li>
	    <li>CVE-2026-5912: Integer overflow in WebRTC.</li>
	    <li>CVE-2026-5913: Out of bounds read in Blink.</li>
	    <li>CVE-2026-5914: Type Confusion in CSS.</li>
	    <li>CVE-2026-5915: Insufficient validation of untrusted input in WebML.</li>
	    <li>CVE-2026-5918: Inappropriate implementation in Navigation.</li>
	    <li>CVE-2026-5919: Insufficient validation of untrusted input in WebSockets.</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-5858</cvename>
      <cvename>CVE-2026-5859</cvename>
      <cvename>CVE-2026-5860</cvename>
      <cvename>CVE-2026-5861</cvename>
      <cvename>CVE-2026-5862</cvename>
      <cvename>CVE-2026-5863</cvename>
      <cvename>CVE-2026-5864</cvename>
      <cvename>CVE-2026-5865</cvename>
      <cvename>CVE-2026-5866</cvename>
      <cvename>CVE-2026-5867</cvename>
      <cvename>CVE-2026-5868</cvename>
      <cvename>CVE-2026-5869</cvename>
      <cvename>CVE-2026-5870</cvename>
      <cvename>CVE-2026-5871</cvename>
      <cvename>CVE-2026-5872</cvename>
      <cvename>CVE-2026-5873</cvename>
      <cvename>CVE-2026-5874</cvename>
      <cvename>CVE-2026-5875</cvename>
      <cvename>CVE-2026-5876</cvename>
      <cvename>CVE-2026-5877</cvename>
      <cvename>CVE-2026-5878</cvename>
      <cvename>CVE-2026-5879</cvename>
      <cvename>CVE-2026-5880</cvename>
      <cvename>CVE-2026-5881</cvename>
      <cvename>CVE-2026-5882</cvename>
      <cvename>CVE-2026-5883</cvename>
      <cvename>CVE-2026-5884</cvename>
      <cvename>CVE-2026-5885</cvename>
      <cvename>CVE-2026-5886</cvename>
      <cvename>CVE-2026-5887</cvename>
      <cvename>CVE-2026-5888</cvename>
      <cvename>CVE-2026-5889</cvename>
      <cvename>CVE-2026-5890</cvename>
      <cvename>CVE-2026-5891</cvename>
      <cvename>CVE-2026-5892</cvename>
      <cvename>CVE-2026-5893</cvename>
      <cvename>CVE-2026-5894</cvename>
      <cvename>CVE-2026-5895</cvename>
      <cvename>CVE-2026-5896</cvename>
      <cvename>CVE-2026-5897</cvename>
      <cvename>CVE-2026-5898</cvename>
      <cvename>CVE-2026-5899</cvename>
      <cvename>CVE-2026-5900</cvename>
      <cvename>CVE-2026-5901</cvename>
      <cvename>CVE-2026-5902</cvename>
      <cvename>CVE-2026-5903</cvename>
      <cvename>CVE-2026-5904</cvename>
      <cvename>CVE-2026-5905</cvename>
      <cvename>CVE-2026-5906</cvename>
      <cvename>CVE-2026-5907</cvename>
      <cvename>CVE-2026-5908</cvename>
      <cvename>CVE-2026-5909</cvename>
      <cvename>CVE-2026-5910</cvename>
      <cvename>CVE-2026-5911</cvename>
      <cvename>CVE-2026-5912</cvename>
      <cvename>CVE-2026-5913</cvename>
      <cvename>CVE-2026-5914</cvename>
      <cvename>CVE-2026-5915</cvename>
      <cvename>CVE-2026-5918</cvename>
      <cvename>CVE-2026-5919</cvename>
      <url>https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-10</entry>
    </dates>
  </vuln>

  <vuln vid="359d8e42-33fb-11f1-8ac1-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>149.0.2,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>149.0.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025475%2C2025477 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2025475%2C2025477">
	<p>
	  Memory safety bugs present in Firefox 149.0.1 and
	  Thunderbird 149.0.1. Some of these bugs showed evidence
	  of memory corruption and we presume that with enough
	  effort some of these could have been exploited to run
	  arbitrary code.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5735</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-5735</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-09</entry>
    </dates>
  </vuln>

  <vuln vid="33e56419-33fb-11f1-8ac1-b42e991fc52e">
    <topic>Mozilla -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>149.0.2,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.9.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>140.9.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022369%2C2023026%2C2023545%2C2023555%2C2023958%2C2025422%2C2025468%2C2025492%2C2025505 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2022369%2C2023026%2C2023545%2C2023555%2C2023958%2C2025422%2C2025468%2C2025492%2C2025505">
	<p>
	  Memory safety bugs present in Firefox ESR 140.9.0,
	  Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird
	  149.0.1. Some of these bugs showed evidence of memory
	  corruption and we presume that with enough effort some of
	  these could have been exploited to run arbitrary code.
	  </p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5734</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-5734</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-09</entry>
    </dates>
  </vuln>

  <vuln vid="322bd409-33fb-11f1-8ac1-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>149.0.2,2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>149.0.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2022554 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2022554">
	<p>
	  Incorrect boundary conditions in the Graphics: WebGPU
	  component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5733</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-5733</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-09</entry>
    </dates>
  </vuln>

  <vuln vid="30522580-33fb-11f1-8ac1-b42e991fc52e">
    <topic>Mozilla -- Incorrect boundary conditions, integer overflow</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>149.0.2,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.9.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>149.0.2</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>140.9.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2017867 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2017867">
	<p>
	  Incorrect boundary conditions, integer overflow in the
	  Graphics: Text component.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5732</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-5732</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-09</entry>
    </dates>
  </vuln>

  <vuln vid="099d4998-33cc-11f1-a7d1-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.10.0</ge><lt>18.10.3</lt></range>
<range><ge>18.9.0</ge><lt>18.9.5</lt></range>
<range><ge>11.3.0</ge><lt>18.8.9</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/">
	  <p>Exposed Method issue in websocket connections impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Terraform state lock API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in GraphQL API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in CSV import impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in GraphQL SBOM API impacts GitLab EE</p>
	  <p>Code Injection issue in Code Quality reports impacts GitLab EE</p>
	  <p>Cross-site Scripting issue in analytics dashboards impacts GitLab EE</p>
	  <p>Incorrect Authorization issue in vulnerability flags AI detection API impacts GitLab EE</p>
	  <p>Information Disclosure issue in certain GraphQl query impacts GitLab EE</p>
	  <p>Improper Access Control issue in Environments API impacts GitLab EE</p>
	  <p>Information Disclosure issue in CSV export impacts GitLab CE/EE</p>
	  <p>Missing Authorization issue in custom role permissions impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5173</cvename>
      <cvename>CVE-2026-1092</cvename>
      <cvename>CVE-2025-12664</cvename>
      <cvename>CVE-2026-1403</cvename>
      <cvename>CVE-2026-1101</cvename>
      <cvename>CVE-2026-1516</cvename>
      <cvename>CVE-2026-4332</cvename>
      <cvename>CVE-2026-2619</cvename>
      <cvename>CVE-2025-9484</cvename>
      <cvename>CVE-2026-1752</cvename>
      <cvename>CVE-2026-2104</cvename>
      <cvename>CVE-2026-4916</cvename>
      <url>https://about.gitlab.com/releases/2026/04/08/patch-release-gitlab-18-10-3-released/</url>
    </references>
    <dates>
      <discovery>2026-04-08</discovery>
      <entry>2026-04-09</entry>
    </dates>
  </vuln>

  <vuln vid="c7a52cee-32ab-11f1-9839-8447094a420f">
    <topic>OpenSSL -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>openssl</name>
	<range><lt>3.0.20,1</lt></range>
      </package>
      <package>
	<name>openssl34</name>
	<range><lt>3.4.5</lt></range>
      </package>
      <package>
	<name>openssl35</name>
	<range><lt>3.5.6</lt></range>
      </package>
      <package>
	<name>openssl36</name>
	<range><lt>3.6.2</lt></range>
      </package>
      <package>
	<name>openssl111</name>
	<range><lt>1.1.1zg</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://openssl-library.org/news/secadv/20260407.txt">
	  <p>Seven vulnerabilities in OpenSSL library. Highest classification Moderate.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-31790</cvename>
      <cvename>CVE-2026-2637</cvename>
      <cvename>CVE-2026-28386</cvename>
      <cvename>CVE-2026-28387</cvename>
      <cvename>CVE-2026-28388</cvename>
      <cvename>CVE-2026-28389</cvename>
      <cvename>CVE-2026-28390</cvename>
      <cvename>CVE-2026-31789</cvename>
      <url>https://openssl-library.org/news/secadv/20260407.txt</url>
    </references>
    <dates>
      <discovery>2026-04-07</discovery>
      <entry>2026-04-07</entry>
    </dates>
  </vuln>

  <vuln vid="c08273b5-30e5-11f1-b9f2-b42e991fc52e">
    <topic>nghttp2 -- CWE-617: Reachable Assertion</topic>
    <affects>
    <package>
	<name>libnghttp2</name>
	<range><lt>1.68.1</lt></range>
    </package>
    <package>
	<name>nghttp2</name>
	<range><lt>1.68.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 reports:</p>
	<blockquote cite="https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6">
	<p>
	nghttp2 is an implementation of the Hypertext Transfer
	Protocol version 2 in C. Prior to version 1.68.1, the
	nghttp2 library stops reading the incoming data when user
	facing public API `nghttp2_session_terminate_session` or
	`nghttp2_session_terminate_session2` is called by the
	application. They might be called internally by the
	library when it detects the situation that is subject to
	connection error. Due to the missing internal state
	validation, the library keeps reading the rest of the data
	after one of those APIs is called. Then receiving a
	malformed frame that causes FRAME_SIZE_ERROR causes
	assertion failure. nghttp2 v1.68.1 adds missing state
	validation to avoid assertion failure. No known
	workarounds are available.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-27135</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-27135</url>
    </references>
    <dates>
      <discovery>2026-03-18</discovery>
      <entry>2026-04-05</entry>
    </dates>
  </vuln>

  <vuln vid="a117f43b-2f7b-11f1-89f4-b42e991fc52e">
    <topic>MongoDB Server -- CWE-617: Reachable Assertion</topic>
    <affects>
    <package>
	<name>mongodb80</name>
	<range><lt>8.0.18</lt></range>
    </package>
    <package>
	<name>mongodb70</name>
	<range><lt>7.0.31</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://jira.mongodb.org/browse/SERVER-101758 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-101758">
	<p>
	A user with access to the cluster with a limited set of
	privilege actions can trigger a crash of amongod process
	during the limited and unpredictable window when the
	cluster is being promoted from a replica set to a sharded
	cluster. This may cause a denial of service by taking
	down the primary of the replica set.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-5170</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-5170</url>
    </references>
    <dates>
      <discovery>2026-03-30</discovery>
      <entry>2026-04-03</entry>
    </dates>
  </vuln>

  <vuln vid="adb096d4-2e72-11f1-acc1-339a1a6999b0">
    <topic>openexr -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>openexr</name>
	<range><lt>3.4.9</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cary Phillips reports:</p>
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9-rc/CHANGES.md#version-349-april--3-2026">
	  <p>[OpenEXR 3.4.9] addresses the following CVEs:</p>
	  <ul>
	    <li>CVE-2026-34589 DWA Lossy Decoder Heap Out-of-Bounds Write</li>
	    <li>CVE-2026-34588 Signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write</li>
	    <li>CVE-2026-34380 Signed integer overflow (undefined behavior) in undo_pxr24_impl may allow bounds-check bypass in PXR24 decompression</li>
	    <li>CVE-2026-34379 Misaligned write in LossyDctDecoder_execute leading to undefined behavior (DWA/DWAB decompression)</li>
	    <li>CVE-2026-34378 Signed integer overflow in generic_unpack() when parsing EXR files with crafted negative dataWindow.min.x</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-34589</cvename>
      <cvename>CVE-2026-34588</cvename>
      <cvename>CVE-2026-34380</cvename>
      <cvename>CVE-2026-34379</cvename>
      <cvename>CVE-2026-34378</cvename>
      <url>https://github.com/AcademySoftwareFoundation/openexr/blob/v3.4.9-rc/CHANGES.md#version-349-april--3-2026</url>
      <url>https://lists.aswf.io/g/openexr-dev/message/5436</url>
    </references>
    <dates>
      <discovery>2026-03-26</discovery>
      <entry>2026-04-02</entry>
    </dates>
  </vuln>

  <vuln vid="9fdad262-2e0f-11f1-88c7-00a098b42aeb">
    <topic>Python -- The webbrowser.open() API allows leading dashes</topic>
    <affects>
    <package><name>python310</name> <range><lt>3.10.20_2</lt></range></package>
    <package><name>python311</name> <range><lt>3.11.15_2</lt></range></package>
    <package><name>python312</name> <range><lt>3.12.13_2</lt></range></package>
    <package><name>python313</name> <range><lt>3.13.12_3</lt></range></package>
    <package><name>python313t</name> <range><lt>3.13.12_3</lt></range></package>
    <package><name>python314</name> <range><lt>3.14.4</lt></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/python/cpython/pull/143931 reports:</p>
	<blockquote cite="https://github.com/python/cpython/pull/143931">
	  <p>The webbrowser.open() API would accept leading dashes in the URL
	  which could be handled as command line options for certain web
	  browsers. New behavior rejects leading dashes. Users are recommended
	  to sanitize URLs prior to passing to webbrowser.open().</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-4519</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-4519</url>
    </references>
    <dates>
      <discovery>2026-03-20</discovery>
      <entry>2026-04-01</entry>
      <modified>2026-04-04</modified>
    </dates>
  </vuln>

  <vuln vid="6d3488ae-2e0f-11f1-88c7-00a098b42aeb">
    <topic>Python -- poplib module, when passed a user-controlled command, can have additional commands injected using newlines</topic>
    <affects>
    <package><name>python310</name> <range><ge>0</ge></range></package>
    <package><name>python311</name> <range><ge>0</ge></range></package>
    <package><name>python312</name> <range><ge>0</ge></range></package>
    <package><name>python313</name> <range><ge>0</ge></range></package>
    <package><name>python313t</name> <range><ge>0</ge></range></package>
    <package><name>python314</name> <range><ge>0</ge></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Python Software Foundation Security Developer reports:</p>
	<blockquote cite="https://github.com/python/cpython/pull/143924">
	  <p>The poplib module, when passed a user-controlled command, can have
	  additional commands injected using newlines. Mitigation rejects
	  commands containing control characters.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-15367</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2025-15367</url>
    </references>
    <dates>
      <discovery>2026-01-20</discovery>
      <entry>2026-04-01</entry>
      <modified>2026-04-04</modified>
    </dates>
  </vuln>

  <vuln vid="0be929a5-2e0f-11f1-88c7-00a098b42aeb">
    <topic>Python -- imaplib module, when passed a user-controlled command, can have additional commands injected using newlines</topic>
    <affects>
    <package><name>python310</name> <range><ge>0</ge></range></package>
    <package><name>python311</name> <range><ge>0</ge></range></package>
    <package><name>python312</name> <range><ge>0</ge></range></package>
    <package><name>python313</name> <range><ge>0</ge></range></package>
    <package><name>python313t</name> <range><ge>0</ge></range></package>
    <package><name>python314</name> <range><ge>0</ge></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Python Software Foundation Security Developer reports:</p>
	<blockquote cite="https://github.com/python/cpython/issues/143921">
	  <p>The imaplib module, when passed a user-controlled command, can have
	  additional commands injected using newlines.  Mitigation rejects
	  commands containing control characters.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-15366</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2025-15366</url>
    </references>
    <dates>
      <discovery>2026-01-20</discovery>
      <entry>2026-04-01</entry>
      <modified>2026-04-04</modified>
    </dates>
  </vuln>

  <vuln vid="1dc2aae1-0793-4dbd-8548-e63ae0e1bdaf">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>146.0.7680.177</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>146.0.7680.177</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html">
	 <p>This update includes 21 security fixes:</p>
	 <ul>
	    <li>[493952652] High CVE-2026-5273: Use after free in CSS. Reported by Anonymous on 2026-03-18</li>
	    <li>[491732188] High CVE-2026-5272: Heap buffer overflow in GPU. Reported by inspector-ambitious on 2026-03-11</li>
	    <li>[488596746] High CVE-2026-5274: Integer overflow in Codecs. Reported by heapracer (@heapracer) on 2026-03-01</li>
	    <li>[489494022] High CVE-2026-5275: Heap buffer overflow in ANGLE. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-04</li>
	    <li>[489711638] High CVE-2026-5276: Insufficient policy enforcement in WebUSB. Reported by Ariel Simon on 2026-03-04</li>
	    <li>[489791424] High CVE-2026-5277: Integer overflow in ANGLE. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-05</li>
	    <li>[490254128] High CVE-2026-5278: Use after free in Web MIDI. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-06</li>
	    <li>[490642836] High CVE-2026-5279: Object corruption in V8. Reported by Hyeonjun Ahn (@_deayzl) on 2026-03-08</li>
	    <li>[491515787] High CVE-2026-5280: Use after free in WebCodecs. Reported by heapracer (@heapracer) on 2026-03-11</li>
	    <li>[491518608] High CVE-2026-5281: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-10</li>
	    <li>[491655161] High CVE-2026-5282: Out of bounds read in WebCodecs. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-11</li>
	    <li>[492131521] High CVE-2026-5283: Inappropriate implementation in ANGLE. Reported by sweetchip on 2026-03-12</li>
	    <li>[492139412] High CVE-2026-5284: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-12</li>
	    <li>[492228019] High CVE-2026-5285: Use after free in WebGL. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-13</li>
	    <li>[493900619] High CVE-2026-5286: Use after free in Dawn. Reported by sweetchip on 2026-03-18</li>
	    <li>[494644471] High CVE-2026-5287: Use after free in PDF. Reported by Syn4pse on 2026-03-21</li>
	    <li>[495507390] High CVE-2026-5288: Use after free in WebView. Reported by Google on 2026-03-23</li>
	    <li>[495931147] High CVE-2026-5289: Use after free in Navigation. Reported by Google on 2026-03-25</li>
	    <li>[496205576] High CVE-2026-5290: Use after free in Compositing. Reported by Google on 2026-03-25</li>
	    <li>[490118036] Medium CVE-2026-5291: Inappropriate implementation in WebGL. Reported by heapracer (@heapracer) on 2026-03-06</li>
	    <li>[492213293] Medium CVE-2026-5292: Out of bounds read in WebCodecs. Reported by Google on 2026-03-12</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-5273</cvename>
      <cvename>CVE-2026-5272</cvename>
      <cvename>CVE-2026-5274</cvename>
      <cvename>CVE-2026-5275</cvename>
      <cvename>CVE-2026-5276</cvename>
      <cvename>CVE-2026-5277</cvename>
      <cvename>CVE-2026-5278</cvename>
      <cvename>CVE-2026-5279</cvename>
      <cvename>CVE-2026-5280</cvename>
      <cvename>CVE-2026-5281</cvename>
      <cvename>CVE-2026-5282</cvename>
      <cvename>CVE-2026-5283</cvename>
      <cvename>CVE-2026-5284</cvename>
      <cvename>CVE-2026-5285</cvename>
      <cvename>CVE-2026-5286</cvename>
      <cvename>CVE-2026-5287</cvename>
      <cvename>CVE-2026-5288</cvename>
      <cvename>CVE-2026-5289</cvename>
      <cvename>CVE-2026-5290</cvename>
      <cvename>CVE-2026-5291</cvename>
      <cvename>CVE-2026-5292</cvename>
      <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_31.html</url>
    </references>
    <dates>
      <discovery>2026-03-31</discovery>
      <entry>2026-04-01</entry>
    </dates>
  </vuln>

  <vuln vid="09e36f7e-2b5b-11f1-852e-5404a68ad561">
    <topic>traefik -- Multiple vulnerabilities</topic>
    <affects>
<package>
<name>traefik</name>
<range><lt>3.6.12</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The traefik project releases a new version addressing multiple CVEs:</p>
	<blockquote cite="https://github.com/traefik/traefik/releases/tag/v3.6.12">
	  <ul>
	    <li>CVE-2026-33433 (BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField)</li>
	    <li>CVE-2026-33186 (authorization bypass via missing leading slash in :path)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-33433</cvename>
      <cvename>CVE-2026-33186</cvename>
      <url>https://github.com/traefik/traefik/releases/tag/v3.6.12</url>
    </references>
    <dates>
      <discovery>2026-03-26</discovery>
      <entry>2026-03-29</entry>
    </dates>
  </vuln>

  <vuln vid="095e9db2-2b5b-11f1-9839-8447094a420f">
    <topic>Roundcube -- SVG Attribute Bypass</topic>
    <affects>
      <package>
	<name>roundcube-php82</name>
	<name>roundcube-php83</name>
	<name>roundcube-php84</name>
	<name>roundcube-php85</name>
	<range><lt>1.6.15,1</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Roundcube project reports:</p>
	<blockquote cite="https://github.com/roundcube/roundcubemail/releases/tag/1.6.15">
	  <p>.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.15</url>
    </references>
    <dates>
      <discovery>2026-03-29</discovery>
      <entry>2026-03-29</entry>
    </dates>
  </vuln>

  <vuln vid="b933083e-2b2e-11f1-b60a-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.10.0</ge><lt>18.10.1</lt></range>
<range><ge>18.9.0</ge><lt>18.9.3</lt></range>
<range><ge>7.11.0</ge><lt>18.8.7</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/">
	  <p>Improper Handling of Parameters issue in Jira Connect installations impacts GitLab CE/EE</p>
	  <p>Cross-Site Request Forgery issue in GLQL API impacts GitLab CE/EE</p>
	  <p>HTML Injection in vulnerability report impacts GitLab EE</p>
	  <p>Denial of Service issue in GraphQL API impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in WebAuthn 2FA impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in GraphQL query impacts GitLab EE</p>
	  <p>Denial of Service issue in CI configuration processing impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in webhook configuration impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in Mermaid diagram renderer impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in Merge Requests impacts GitLab CE/EE</p>
	  <p>Access Control issue in GraphQL API impacts GitLab EE</p>
	  <p>Incorrect Authorization issue in authorization caching impacts GitLab EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-2370</cvename>
      <cvename>CVE-2026-3857</cvename>
      <cvename>CVE-2026-2995</cvename>
      <cvename>CVE-2026-3988</cvename>
      <cvename>CVE-2026-2745</cvename>
      <cvename>CVE-2026-1724</cvename>
      <cvename>CVE-2025-13436</cvename>
      <cvename>CVE-2025-13078</cvename>
      <cvename>CVE-2026-2973</cvename>
      <cvename>CVE-2026-2726</cvename>
      <cvename>CVE-2025-14595</cvename>
      <cvename>CVE-2026-4363</cvename>
      <url>https://about.gitlab.com/releases/2026/03/25/patch-release-gitlab-18-10-1-released/</url>
    </references>
    <dates>
      <discovery>2026-03-25</discovery>
      <entry>2026-03-29</entry>
    </dates>
  </vuln>

  <vuln vid="970fd0ec-26f5-11f1-a9b1-0cc47ada5f32">
    <topic>jenkins -- multiple vulnerabilities</topic>
    <affects>
    <package>
	<name>jenkins</name>
	<range><lt>2.555</lt></range>
    </package>
    <package>
	<name>jenkins-lts</name>
	<range><lt>2.541.3</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory 2026-03-18:</p>
	<blockquote cite="https://www.jenkins.io/security/advisory/2026-03-18/">
	  <ul>
	    <li>SECURITY-3657 / CVE-2026-33001: Arbitrary file write
	    vulnerability through specially crafted archives in Jenkins
	    (High)</li>
	    <li>SECURITY-3674 / CVE-2026-33002: DNS rebinding vulnerability
	    in WebSocket CLI origin validation in Jenkins (High)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-33001</cvename>
      <cvename>CVE-2026-33002</cvename>
      <url>https://www.jenkins.io/security/advisory/2026-03-18/</url>
    </references>
    <dates>
      <discovery>2026-03-18</discovery>
      <entry>2026-03-27</entry>
    </dates>
  </vuln>

  <vuln vid="26c24872-2943-11f1-8461-b42e991fc52e">
    <topic>Mozilla -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>149.0.0,2</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>149.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-4729: Memory safety bugs</p>
	<p>CVE-2026-4728: Spoofing issue in the Privacy: Anti-Tracking
	component.</p>
	<p>CVE-2026-4727: Denial-of-service in the Libraries component
	in NSS.</p>
	<p>CVE-2026-4726: Denial-of-service in the XML component.</p>
	<p>CVE-2026-4725: Sandbox escape due to use-after-free in the
	Graphics: Canvas2D component.</p>
	<p>CVE-2026-4724: Undefined behavior in the Audio/Video
	component.</p>
	<p>CVE-2026-4723: Use-after-free in the JavaScript Engine
	component.</p>
	<p>CVE-2026-4722: Privilege escalation in the IPC component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4729</cvename>
      <cvename>CVE-2026-4728</cvename>
      <cvename>CVE-2026-4727</cvename>
      <cvename>CVE-2026-4726</cvename>
      <cvename>CVE-2026-4725</cvename>
      <cvename>CVE-2026-4724</cvename>
      <cvename>CVE-2026-4723</cvename>
      <cvename>CVE-2026-4722</cvename>
    </references>
    <dates>
      <discovery>2026-03-24</discovery>
      <entry>2026-03-26</entry>
    </dates>
  </vuln>

  <vuln vid="32819a60-2943-11f1-8461-b42e991fc52e">
    <topic>Mozilla -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>149.0.0,2</lt></range>
      </package>
      <package>
	<name>firefox-esr</name>
	<range><lt>140.9.0</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>149.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-4721: Memory safety bugs. Potential arbitrary code
	execution.</p>
	<p>CVE-2026-4709: Incorrect boundary conditions in the
	Audio/Video: GMP component.</p>
	<p>CVE-2026-4707: Incorrect boundary conditions in the Graphics:
	Canvas2D component.</p>
	<p>CVE-2026-4706: Incorrect boundary conditions in the Graphics:
	Canvas2D component.</p>
	<p>CVE-2026-4699: Incorrect boundary conditions in the Layout:
	Text and Fonts component.</p>
	<p>CVE-2026-4698: JIT miscompilation in the JavaScript Engine:
	JIT component.</p>
	<p>CVE-2026-4696: Use-after-free in the Layout: Text and Fonts
	component.</p>
	<p>CVE-2026-4694: Incorrect boundary conditions, integer
	overflow in the Graphics component.</p>
	<p>CVE-2026-4693: Incorrect boundary conditions in the
	Audio/Video: Playback component.</p>
	<p>CVE-2026-4692: Sandbox escape in the Responsive Design Mode
	component.</p>
	<p>CVE-2026-4691: Use-after-free in the CSS Parsing and
	Computation component.</p>
	<p>CVE-2026-4690: Sandbox escape due to integer overflow in the
	XPCOM component.</p>
	<p>CVE-2026-4689: Sandbox escape due to integer overflow in the
	XPCOM component.</p>
	<p>CVE-2026-4687: Sandbox escape in the Telemetry component.</p>
	<p>CVE-2026-4686: Incorrect boundary conditions in the Graphics:
	Canvas2D component.</p>
	<p>CVE-2026-4685: Incorrect boundary conditions in the Graphics:
	Canvas2D component.</p>
	<p>CVE-2026-4684: Race condition, use-after-free in the
	Graphics: WebRender component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4721</cvename>
      <cvename>CVE-2026-4709</cvename>
      <cvename>CVE-2026-4707</cvename>
      <cvename>CVE-2026-4706</cvename>
      <cvename>CVE-2026-4699</cvename>
      <cvename>CVE-2026-4698</cvename>
      <cvename>CVE-2026-4696</cvename>
      <cvename>CVE-2026-4694</cvename>
      <cvename>CVE-2026-4693</cvename>
      <cvename>CVE-2026-4692</cvename>
      <cvename>CVE-2026-4691</cvename>
      <cvename>CVE-2026-4690</cvename>
      <cvename>CVE-2026-4689</cvename>
      <cvename>CVE-2026-4687</cvename>
      <cvename>CVE-2026-4686</cvename>
      <cvename>CVE-2026-4685</cvename>
      <cvename>CVE-2026-4684</cvename>
    </references>
    <dates>
      <discovery>2026-03-24</discovery>
      <entry>2026-03-26</entry>
    </dates>
  </vuln>

  <vuln vid="6d445322-2945-11f1-8461-b42e991fc52e">
    <topic>Mozilla -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>149.0.0,2</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>149.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-4688: Sandbox escape due to use-after-free in
	Disability Access APIs.</p>
	<p>CVE-2026-4695: Incorrect boundary conditions in the
	Audio/Video: Web Codecs component.</p>
	<p>CVE-2026-4697: Incorrect boundary conditions in the
	Audio/Video: Web Codecs component.</p>
	<p>CVE-2026-4700: Mitigation bypass in the Networking: HTTP
	component.</p>
	<p>CVE-2026-4701: Use-after-free in the JavaScript Engine
	component.</p>
	<p>CVE-2026-4702: JIT miscompilation in the JavaScript Engine
	component.</p>
	<p>CVE-2026-4704: Denial-of-service in the WebRTC: Signaling
	component.</p>
	<p>CVE-2026-4705: Undefined behavior in the WebRTC: Signaling
	component.</p>
	<p>CVE-2026-4708: Incorrect boundary conditions in the Graphics
	component.</p>
	<p>CVE-2026-4710: Incorrect boundary conditions in the
	Audio/Video component.</p>
	<p>CVE-2026-4711: Use-after-free in the Widget: Cocoa
	component.</p>
	<p>CVE-2026-4712: Information disclosure in the Widget: Cocoa
	component.</p>
	<p>CVE-2026-4713: Incorrect boundary conditions in the Graphics
	component.</p>
	<p>CVE-2026-4714: Incorrect boundary conditions in the
	Audio/Video component.</p>
	<p>CVE-2026-4715: Uninitialized memory in the Graphics: Canvas2D
	component.</p>
	<p>CVE-2026-4716: Incorrect boundary conditions and
	uninitialized memory in the JavaScript Engine.</p>
	<p>CVE-2026-4717: Privilege escalation in the Netmonitor
	component.</p>
	<p>CVE-2026-4718: Undefined behavior in the WebRTC: Signaling
	component.</p>
	<p>CVE-2026-4719: Incorrect boundary conditions in the Graphics:
	Text component.</p>
	<p>CVE-2026-4720: Memory safety bugs</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4688</cvename>
      <cvename>CVE-2026-4695</cvename>
      <cvename>CVE-2026-4697</cvename>
      <cvename>CVE-2026-4700</cvename>
      <cvename>CVE-2026-4701</cvename>
      <cvename>CVE-2026-4702</cvename>
      <cvename>CVE-2026-4704</cvename>
      <cvename>CVE-2026-4705</cvename>
      <cvename>CVE-2026-4708</cvename>
      <cvename>CVE-2026-4710</cvename>
      <cvename>CVE-2026-4711</cvename>
      <cvename>CVE-2026-4712</cvename>
      <cvename>CVE-2026-4713</cvename>
      <cvename>CVE-2026-4714</cvename>
      <cvename>CVE-2026-4715</cvename>
      <cvename>CVE-2026-4716</cvename>
      <cvename>CVE-2026-4717</cvename>
      <cvename>CVE-2026-4718</cvename>
      <cvename>CVE-2026-4719</cvename>
      <cvename>CVE-2026-4720</cvename>
    </references>
    <dates>
      <discovery>2026-03-24</discovery>
      <entry>2026-03-26</entry>
    </dates>
  </vuln>

  <vuln vid="733febba-28d2-11f1-b35e-bc241121aa0a">
    <topic>FreeBSD -- Remote code execution via RPCSEC_GSS packet validation</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_5</lt></range>
	<range><ge>14.4</ge><lt>14.4_1</lt></range>
	<range><ge>14.3</ge><lt>14.3_10</lt></range>
	<range><ge>13.5</ge><lt>13.5_11</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>Each RPCSEC_GSS data packet is validated by a routine which
	  checks a signature in the packet.  This routine copies a portion
	  of the packet into a stack buffer, but fails to ensure that the
	  buffer is sufficiently large, and a malicious client can trigger a
	  stack overflow.  Notably, this does not require the client to
	  authenticate itself first.</p>
	<h1>Impact:</h1>
	  <p>As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote
	  code execution in the kernel is possible by an authenticated user
	  that is able to send packets to the kernel's NFS server while
	  kgssapi.ko is loaded into the kernel.</p>
	  <p>In userspace, applications which have librpcgss_sec loaded and run
	  an RPC server are vulnerable to remote code execution from any
	  client able to send it packets.  We are not aware of any such
	  applications in the FreeBSD base system.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4747</cvename>
      <freebsdsa>SA-26:08.rpcsec_gss</freebsdsa>
    </references>
    <dates>
      <discovery>2026-03-25</discovery>
      <entry>2026-03-26</entry>
    </dates>
  </vuln>

  <vuln vid="11bf64f0-28d2-11f1-b35e-bc241121aa0a">
    <topic>FreeBSD -- Remote denial of service via null pointer dereference</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>On a system exposing an NVMe/TCP target, a remote client can
	  trigger a kernel panic by sending a CONNECT command for an I/O queue
	  with a bogus or stale CNTLID.</p>
	<h1>Impact:</h1>
	  <p>An attacker with network access to the NVMe/TCP target can
	  trigger an unauthenticated Denial of Service condition on the
	  affected machine.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4652</cvename>
      <freebsdsa>SA-26:07.nvmf</freebsdsa>
    </references>
    <dates>
      <discovery>2026-03-25</discovery>
      <entry>2026-03-26</entry>
    </dates>
  </vuln>

  <vuln vid="7aa913e9-28d1-11f1-b35e-bc241121aa0a">
    <topic>FreeBSD -- TCP: remotely exploitable DoS vector (mbuf leak)</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_5</lt></range>
	<range><ge>14.4</ge><lt>14.4_1</lt></range>
	<range><ge>14.3</ge><lt>14.3_10</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>When a challenge ACK is to be sent tcp_respond() constructs and
	  sends the challenge ACK and consumes the mbuf that is passed in.
	  When no challenge ACK should be sent the function returns and leaks
	  the mbuf.</p>
	<h1>Impact:</h1>
	  <p>If an attacker is either on path with an established TCP
	  connection, or can themselves establish a TCP connection, to an
	  affected FreeBSD machine, they can easily craft and send packets
	  which meet the challenge ACK criteria and cause the FreeBSD host
	  to leak an mbuf for each crafted packet in excess of the configured
	  rate limit settings i.e.  with default settings, crafted packets
	  in excess of the first 5 sent within a 1s period will leak an mbuf.</p>
	  <p>Technically, off-path attackers can also exploit this problem by
	  guessing the IP addresses, TCP port numbers and in some cases the
	  sequence numbers of established connections and spoofing packets
	  towards a FreeBSD machine, but this is harder to do effectively.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4247</cvename>
      <freebsdsa>SA-26:06.tcp</freebsdsa>
    </references>
    <dates>
      <discovery>2026-03-25</discovery>
      <entry>2026-03-26</entry>
    </dates>
  </vuln>

  <vuln vid="07d6b170-fed8-4ee2-ba96-b6d61b6d6a26">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>146.0.7680.164</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>146.0.7680.164</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html">
	 <p>This update includes 8 security fixes:</p>
	 <ul>
	    <li>[485397284] High CVE-2026-4673: Heap buffer overflow in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18</li>
	    <li>[488188166] High CVE-2026-4674: Out of bounds read in CSS. Reported by Syn4pse on 2026-02-27</li>
	    <li>[488270257] High CVE-2026-4675: Heap buffer overflow in WebGL. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-02-27</li>
	    <li>[488613135] High CVE-2026-4676: Use after free in Dawn. Reported by 86ac1f1587b71893ed2ad792cd7dde32 on 2026-03-01</li>
	    <li>[490533968] High CVE-2026-4677: Out of bounds read in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-07</li>
	    <li>[491164019] High CVE-2026-4678: Use after free in WebGPU. Reported by Google on 2026-03-10</li>
	    <li>[491516670] High CVE-2026-4679: Integer overflow in Fonts. Reported by GF, Un3xploitable Of DeadSec on 2026-03-11</li>
	    <li>[491869946] High CVE-2026-4680: Use after free in FedCM. Reported by Shaheen Fazim on 2026-03-12</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4673</cvename>
      <cvename>CVE-2026-4674</cvename>
      <cvename>CVE-2026-4675</cvename>
      <cvename>CVE-2026-4676</cvename>
      <cvename>CVE-2026-4677</cvename>
      <cvename>CVE-2026-4678</cvename>
      <cvename>CVE-2026-4679</cvename>
      <cvename>CVE-2026-4680</cvename>
      <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_23.html</url>
    </references>
    <dates>
      <discovery>2026-03-23</discovery>
      <entry>2026-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="3c370171-b6b6-463a-8746-ee49bea08c87">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>146.0.7680.153</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>146.0.7680.153</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html">
	 <p>This update includes 26 security fixes:</p>
	 <ul>
	    <li>[475877320] Critical CVE-2026-4439: Out of bounds memory access in WebGL. Reported by Goodluck on 2026-01-15</li>
	    <li>[485935305] Critical CVE-2026-4440: Out of bounds read and write in WebGL. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-20</li>
	    <li>[489381399] Critical CVE-2026-4441: Use after free in Base. Reported by Google on 2026-03-03</li>
	    <li>[484751092] High CVE-2026-4442: Heap buffer overflow in CSS. Reported by Syn4pse on 2026-02-16</li>
	    <li>[485292589] High CVE-2026-4443: Heap buffer overflow in WebAudio. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18</li>
	    <li>[486349161] High CVE-2026-4444: Stack buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-21</li>
	    <li>[486421953] High CVE-2026-4445: Use after free in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22</li>
	    <li>[486421954] High CVE-2026-4446: Use after free in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-22</li>
	    <li>[486657483] High CVE-2026-4447: Inappropriate implementation in V8. Reported by Erge on 2026-02-23</li>
	    <li>[486972661] High CVE-2026-4448: Heap buffer overflow in ANGLE. Reported by M. Fauzan Wijaya (Gh05t666nero) on 2026-02-23</li>
	    <li>[487117772] High CVE-2026-4449: Use after free in Blink. Reported by Syn4pse on 2026-02-24</li>
	    <li>[487746373] High CVE-2026-4450: Out of bounds write in V8. Reported by qymag1c on 2026-02-26</li>
	    <li>[487768779] High CVE-2026-4451: Insufficient validation of untrusted input in Navigation. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-26</li>
	    <li>[487977696] High CVE-2026-4452: Integer overflow in ANGLE. Reported by cinzinga on 2026-02-26</li>
	    <li>[488400770] High CVE-2026-4453: Integer overflow in Dawn. Reported by sweetchip on 2026-02-27</li>
	    <li>[488585488] High CVE-2026-4454: Use after free in Network. Reported by heapracer (@heapracer) on 2026-03-01</li>
	    <li>[488585504] High CVE-2026-4455: Heap buffer overflow in PDFium. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-01</li>
	    <li>[488617440] High CVE-2026-4456: Use after free in Digital Credentials API. Reported by sean wong on 2026-02-28</li>
	    <li>[488803413] High CVE-2026-4457: Type Confusion in V8. Reported by Zhenpeng (Leo) Lin at depthfirst on 2026-03-01</li>
	    <li>[489619753] High CVE-2026-4458: Use after free in Extensions. Reported by Shaheen Fazim on 2026-03-04</li>
	    <li>[490246422] High CVE-2026-4459: Out of bounds read and write in WebAudio. Reported by Jihyeon Jeong (Compsec Lab, Seoul National University / Research Intern) on 2026-03-06</li>
	    <li>[490254124] High CVE-2026-4460: Out of bounds read in Skia. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-06</li>
	    <li>[490558172] High CVE-2026-4461: Inappropriate implementation in V8. Reported by Google on 2026-03-07</li>
	    <li>[491080830] High CVE-2026-4462: Out of bounds read in Blink. Reported by heapracer (@heapracer) on 2026-03-09</li>
	    <li>[491358681] High CVE-2026-4463: Heap buffer overflow in WebRTC. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-03-10</li>
	    <li>[487208468] Medium CVE-2026-4464: Integer overflow in ANGLE. Reported by heesun on 2026-02-24</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-4439</cvename>
      <cvename>CVE-2026-4440</cvename>
      <cvename>CVE-2026-4441</cvename>
      <cvename>CVE-2026-4442</cvename>
      <cvename>CVE-2026-4443</cvename>
      <cvename>CVE-2026-4444</cvename>
      <cvename>CVE-2026-4445</cvename>
      <cvename>CVE-2026-4446</cvename>
      <cvename>CVE-2026-4447</cvename>
      <cvename>CVE-2026-4448</cvename>
      <cvename>CVE-2026-4449</cvename>
      <cvename>CVE-2026-4450</cvename>
      <cvename>CVE-2026-4451</cvename>
      <cvename>CVE-2026-4452</cvename>
      <cvename>CVE-2026-4453</cvename>
      <cvename>CVE-2026-4454</cvename>
      <cvename>CVE-2026-4455</cvename>
      <cvename>CVE-2026-4456</cvename>
      <cvename>CVE-2026-4457</cvename>
      <cvename>CVE-2026-4458</cvename>
      <cvename>CVE-2026-4459</cvename>
      <cvename>CVE-2026-4460</cvename>
      <cvename>CVE-2026-4461</cvename>
      <cvename>CVE-2026-4462</cvename>
      <cvename>CVE-2026-4463</cvename>
      <cvename>CVE-2026-4464</cvename>
      <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_18.html</url>
    </references>
    <dates>
      <discovery>2026-03-18</discovery>
      <entry>2026-03-24</entry>
    </dates>
  </vuln>

  <vuln vid="832a823b-25b5-11f1-b6f8-5404a68ad561">
    <topic>traefik -- Multiple vulnerabilities</topic>
    <affects>
    <package>
	<name>traefik</name>
	<range><lt>3.6.11</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The traefik project releases a new version addressing multiple CVEs:</p>
	<blockquote cite="https://github.com/traefik/traefik/releases/tag/v3.6.11">
	  <ul>
	    <li>CVE-2026-32595 (BasicAuth Middleware Timing Attack)</li>
	    <li>CVE-2026-32305 (Potential mTLS Bypass via Fragmented TLS ClientHello)</li>
	    <li>CVE-2026-32695 (Details not yet available)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-32595</cvename>
      <cvename>CVE-2026-32305</cvename>
      <cvename>CVE-2026-32695</cvename>
      <url>https://github.com/traefik/traefik/releases/tag/v3.6.11</url>
    </references>
    <dates>
      <discovery>2026-03-19</discovery>
      <entry>2026-03-22</entry>
    </dates>
  </vuln>

  <vuln vid="71b4ce56-23c5-11f1-b865-b42e991fc52e">
    <topic>UniFi Network Application - Multiple vulnerabilities</topic>
    <affects>
    <package>
	<name>unifi10</name>
	<range><lt>10.1.89</lt></range>
    </package>
    <package>
	<name>unifi9</name>
	<range><lt>9.0.114</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b reports:</p>
	<blockquote cite="https://community.ui.com/releases/Security-Advisory-Bulletin-062-062/c29719c0-405e-4d4a-8f26-e343e99f931b">
	  <p>An Authenticated NoSQL Injection vulnerability found in
	  UniFi Network Application could allow a malicious actor with
	  authenticated access to the network to escalate
	  privileges.</p>
	  <p>A malicious actor with access to the network could
	  exploit a Path Traversal vulnerability found in the UniFi
	  Network Application to access files on the underlying system
	  that could be manipulated to access an underlying
	  account.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-22558</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-22558</url>
      <cvename>CVE-2026-22557</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-22557</url>
    </references>
    <dates>
      <discovery>2026-03-19</discovery>
      <entry>2026-03-19</entry>
    </dates>
  </vuln>

  <vuln vid="c5b93cb5-2363-11f1-81da-8447094a420f">
    <topic>Roundcube -- Multiple vulnerabilities</topic>
    <affects>
	<package>
	<name>roundcube-php82</name>
	<name>roundcube-php83</name>
	<name>roundcube-php84</name>
	<name>roundcube-php85</name>
	<range><lt>1.6.14,1</lt></range>
	</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Roundcube project reports:</p>
	<blockquote cite="https://github.com/roundcube/roundcubemail/releases/tag/1.6.14">
	  <p>pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler</p>
	  <p>password could get changed without providing the old password</p>
	  <p>IMAP Injection + CSRF bypass in mail search</p>
	  <p>remote image blocking bypass via various SVG animate attributes</p>
	  <p>remote image blocking bypass via a crafted body background attribute</p>
	  <p>fixed position mitigation bypass via use of !important</p>
	  <p>XSS issue in a HTML attachment preview</p>
	  <p>SSRF + Information Disclosure via stylesheet links to a local network hosts</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.14</url>
    </references>
    <dates>
      <discovery>2026-03-18</discovery>
      <entry>2026-03-19</entry>
    </dates>
  </vuln>

  <vuln vid="db3bdcc6-377f-47d9-9ce8-4bdede4fdafe">
    <topic>homebox -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>homebox</name>
	<range><lt>0.24.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Homebox reports:</p>
	<ul>
	  <li>[HIGH] CVE-2026-27981: Auth Rate Limit Bypass via IP Spoofing</li>
	  <li>[MODERATE] CVE-2026-27600: Blind SSRF</li>
	  <li>[MODERATE] CVE-2026-26272: Stored XSS via HTML/SVG Attachment Upload</li>
	</ul>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-27981</cvename>
      <cvename>CVE-2026-27600</cvename>
      <cvename>CVE-2026-26272</cvename>
    </references>
    <dates>
      <discovery>2026-03-01</discovery>
      <entry>2026-03-17</entry>
    </dates>
  </vuln>

  <vuln vid="73eeb578-fd13-4d79-b50b-ed25c3614528">
    <topic>chromium -- security fix</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>146.0.7680.80</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>146.0.7680.80</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html">
	 <p>This update includes 1 security fix:</p>
	 <ul>
	    <li>[491421267] High CVE-2026-3909: Out of bounds write in Skia. Reported by Google Threat Analysis Group on 2026-03-10</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-3909</cvename>
      <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_13.html</url>
    </references>
    <dates>
      <discovery>2026-03-13</discovery>
      <entry>2026-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="26776062-fd24-4c2f-bf6c-7f231948ab19">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>146.0.7680.75</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>146.0.7680.75</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html">
	 <p>This update includes 2 security fixes:</p>
	 <ul>
	    <li>[491421267] High CVE-2026-3909: Out of bounds write in Skia. Reported by Google on 2026-03-10</li>
	    <li>[491410818] High CVE-2026-3910: Inappropriate implementation in V8. Reported by Google on 2026-03-10</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-3909</cvename>
      <cvename>CVE-2026-3910</cvename>
      <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_12.html</url>
    </references>
    <dates>
      <discovery>2026-03-12</discovery>
      <entry>2026-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="e45fb606-b731-4871-881d-27a1d5e2fd03">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>146.0.7680.71</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>146.0.7680.71</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html">
	 <p>This update includes 29 security fixes:</p>
	 <ul>
	    <li>[483445078] Critical CVE-2026-3913: Heap buffer overflow in WebML. Reported by Tobias Wienand on 2026-02-10</li>
	    <li>[481776048] High CVE-2026-3914: Integer overflow in WebML. Reported by cinzinga on 2026-02-04</li>
	    <li>[483971526] High CVE-2026-3915: Heap buffer overflow in WebML. Reported by Tobias Wienand on 2026-02-12</li>
	    <li>[482828615] High CVE-2026-3916: Out of bounds read in Web Speech. Reported by Grischa Hauser on 2026-02-09</li>
	    <li>[483569512] High CVE-2026-3917: Use after free in Agents. Reported by Syn4pse on 2026-02-11</li>
	    <li>[483853103] High CVE-2026-3918: Use after free in WebMCP. Reported by Syn4pse on 2026-02-12</li>
	    <li>[444176961] High CVE-2026-3919: Use after free in Extensions. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2025-09-10</li>
	    <li>[482875307] High CVE-2026-3920: Out of bounds memory access in WebML. Reported by Google on 2026-02-09</li>
	    <li>[484946544] High CVE-2026-3921: Use after free in TextEncoding. Reported by Pranamya Keshkamat &amp; Cantina.xyz on 2026-02-17</li>
	    <li>[485397139] High CVE-2026-3922: Use after free in MediaStream. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-18</li>
	    <li>[485935314] High CVE-2026-3923: Use after free in WebMIDI. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-20</li>
	    <li>[487338366] High CVE-2026-3924: Use after free in WindowDialog. Reported by c6eed09fc8b174b0f3eebedcceb1e792 on 2026-02-25</li>
	    <li>[418214610] Medium CVE-2026-3925: Incorrect security UI in LookalikeChecks. Reported by NDevTK and Alesandro Ortiz on 2025-05-17</li>
	    <li>[478659010] Medium CVE-2026-3926: Out of bounds read in V8. Reported by qymag1c on 2026-01-26</li>
	    <li>[474948986] Medium CVE-2026-3927: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K on 2026-01-11</li>
	    <li>[435980394] Medium CVE-2026-3928: Insufficient policy enforcement in Extensions. Reported by portsniffer443 on 2025-08-03</li>
	    <li>[477180001] Medium CVE-2026-3929: Side-channel information leakage in ResourceTiming. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-20</li>
	    <li>[476898368] Medium CVE-2026-3930: Unsafe navigation in Navigation. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-19</li>
	    <li>[417599694] Medium CVE-2026-3931: Heap buffer overflow in Skia. Reported by Huinian Yang (@vmth6) of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2025-05-14</li>
	    <li>[478296121] Medium CVE-2026-3932: Insufficient policy enforcement in PDF. Reported by Ayato Shitomi on 2026-01-23   </li>
	    <li>[478783560] Medium CVE-2026-3934: Insufficient policy enforcement in ChromeDriver. Reported by Povcfe of Tencent Security Xuanwu Lab on 2026-01-26</li>
	    <li>[479326680] Medium CVE-2026-3935: Incorrect security UI in WebAppInstalls. Reported by Barath Stalin K on 2026-01-28</li>
	    <li>[481920229] Medium CVE-2026-3936: Use after free in WebView. Reported by Am4deu$ on 2026-02-05</li>
	    <li>[473118648] Low CVE-2026-3937: Incorrect security UI in Downloads. Reported by Abhishek Kumar on 2026-01-03</li>
	    <li>[474763968] Low CVE-2026-3938: Insufficient policy enforcement in Clipboard. Reported by vicevirus on 2026-01-10</li>
	    <li>[40058077] Low CVE-2026-3939: Insufficient policy enforcement in PDF. Reported by NDevTK on 2021-11-30</li>
	    <li>[470574526] Low CVE-2026-3940: Insufficient policy enforcement in DevTools. Reported by Jorian Woltjer, Mian, bug_blitzer on 2025-12-21</li>
	    <li>[474670215] Low CVE-2026-3941: Insufficient policy enforcement in DevTools. Reported by Lyra Rebane (rebane2001) on 2026-01-10</li>
	    <li>[475238879] Low CVE-2026-3942: Incorrect security UI in PictureInPicture. Reported by Barath Stalin K on 2026-01-12</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-3913</cvename>
      <cvename>CVE-2026-3914</cvename>
      <cvename>CVE-2026-3915</cvename>
      <cvename>CVE-2026-3916</cvename>
      <cvename>CVE-2026-3917</cvename>
      <cvename>CVE-2026-3918</cvename>
      <cvename>CVE-2026-3919</cvename>
      <cvename>CVE-2026-3920</cvename>
      <cvename>CVE-2026-3921</cvename>
      <cvename>CVE-2026-3922</cvename>
      <cvename>CVE-2026-3923</cvename>
      <cvename>CVE-2026-3924</cvename>
      <cvename>CVE-2026-3925</cvename>
      <cvename>CVE-2026-3926</cvename>
      <cvename>CVE-2026-3927</cvename>
      <cvename>CVE-2026-3928</cvename>
      <cvename>CVE-2026-3929</cvename>
      <cvename>CVE-2026-3930</cvename>
      <cvename>CVE-2026-3931</cvename>
      <cvename>CVE-2026-3932</cvename>
      <cvename>CVE-2026-3934</cvename>
      <cvename>CVE-2026-3935</cvename>
      <cvename>CVE-2026-3936</cvename>
      <cvename>CVE-2026-3937</cvename>
      <cvename>CVE-2026-3938</cvename>
      <cvename>CVE-2026-3939</cvename>
      <cvename>CVE-2026-3940</cvename>
      <cvename>CVE-2026-3941</cvename>
      <cvename>CVE-2026-3942</cvename>
      <url>https://chromereleases.googleblog.com/2026/03/stable-channel-update-for-desktop_10.html</url>
    </references>
    <dates>
      <discovery>2026-03-10</discovery>
      <entry>2026-03-15</entry>
    </dates>
  </vuln>

  <vuln vid="ee1e6a24-1eeb-11f1-81da-8447094a420f">
    <topic>OpenSSL -- key agreement vulnerability</topic>
    <affects>
      <package>
	<name>openssl35</name>
	<range><lt>3.5.5_1</lt></range>
      </package>
      <package>
	<name>openssl36</name>
	<range><lt>3.6.1_1</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://openssl-library.org/news/secadv/20260313.txt">
	  <p>TLS 1.3 server may choose unexpected key agreement group (Low)</p>
	  <p>An OpenSSL TLS 1.3 server may fail to negotiate the expected
	    preferred key exchange group when its key exchange group configuration includes
	    the default by using the "DEFAULT" keyword.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-2673</cvename>
      <url>https://openssl-library.org/news/secadv/20260313.txt</url>
    </references>
    <dates>
      <discovery>2026-03-13</discovery>
      <entry>2026-03-13</entry>
    </dates>
  </vuln>

  <vuln vid="b45d25ab-1de3-11f1-8aff-b42e991fc52e">
    <topic>Mozilla -- Undefined behavior in the DOM: Core &amp; HTML component</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>148.0.0,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.8.0</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>148.0.0</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2014593 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2014593">
	  <p>Undefined behavior in the DOM: Core &amp; HTML component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-2771</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-2771</url>
    </references>
    <dates>
      <discovery>2026-02-24</discovery>
      <entry>2026-03-12</entry>
    </dates>
  </vuln>

  <vuln vid="e1e40d50-1de2-11f1-8aff-b42e991fc52e">
    <topic>Firefox -- Same-origin policy bypass</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>148.0.2,2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2018400 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2018400">
	  <p>Same-origin policy bypass in the CSS Parsing and
	    Computation component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-3846</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-3846</url>
    </references>
    <dates>
      <discovery>2026-03-10</discovery>
      <entry>2026-03-12</entry>
    </dates>
  </vuln>

  <vuln vid="df82f42c-1de2-11f1-8aff-b42e991fc52e">
    <topic>firefox -- Memory safety bugs</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>148.0.2,2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/buglist.cgi?bug_id=2017513%2C2017622%2C2019341 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/buglist.cgi?bug_id=2017513%2C2017622%2C2019341">
	  <p>Memory safety bugs present in Firefox 148.0.2.  Some of
	  these bugs showed evidence of memory corruption and we
	  presume that with enough effort some of these could have
	  been exploited to run arbitrary code.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-3847</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-3847</url>
    </references>
    <dates>
      <discovery>2026-03-10</discovery>
      <entry>2026-03-12</entry>
    </dates>
  </vuln>

  <vuln vid="0236eab0-1d62-11f1-88f8-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.9.0</ge><lt>18.9.2</lt></range>
<range><ge>18.8.0</ge><lt>18.8.6</lt></range>
<range><ge>1.0.0</ge><lt>18.7.6</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/">
	  <p>Cross-site Scripting issue in Markdown placeholder processing impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in GraphQL API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in repository archive endpoint impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in protected branches API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in webhook custom headers impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in webhook endpoint impacts GitLab CE/EE</p>
	  <p>Improper Neutralization of CRLF Sequences issue impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in runners API impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in snippet rendering impacts GitLab CE/EE</p>
	  <p>Information Disclosure issue in inaccessible issues impacts GitLab CE/EE</p>
	  <p>Missing Authorization issue in Group Import impacts GitLab CE/EE</p>
	  <p>Incorrect Reference issue in repository download impacts GitLab CE/EE</p>
	  <p>Incorrect Authorization issue in Virtual Registry impacts GitLab EE</p>
	  <p>Improper Escaping of Output issue in Datadog integration impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-1090</cvename>
      <cvename>CVE-2026-1069</cvename>
      <cvename>CVE-2025-13929</cvename>
      <cvename>CVE-2025-14513</cvename>
      <cvename>CVE-2025-13690</cvename>
      <cvename>CVE-2025-12576</cvename>
      <cvename>CVE-2026-3848</cvename>
      <cvename>CVE-2025-12555</cvename>
      <cvename>CVE-2026-0602</cvename>
      <cvename>CVE-2026-1732</cvename>
      <cvename>CVE-2026-1663</cvename>
      <cvename>CVE-2026-1230</cvename>
      <cvename>CVE-2025-12704</cvename>
      <cvename>CVE-2025-12697</cvename>
      <url>https://about.gitlab.com/releases/2026/03/11/patch-release-gitlab-18-9-2-released/</url>
    </references>
    <dates>
      <discovery>2026-03-11</discovery>
      <entry>2026-03-11</entry>
    </dates>
  </vuln>

  <vuln vid="086d53fa-1d47-11f1-81da-8447094a420f">
    <topic>curl -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>curl</name>
	<range><lt>8.18.0</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The curl project reports:</p>
	<blockquote cite="https://curl.se/docs/vuln-8.17.0.html">
	  <p>Multiple vulnerabilities</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-15224</cvename>
      <cvename>CVE-2025-15079</cvename>
      <cvename>CVE-2025-14819</cvename>
      <cvename>CVE-2025-14524</cvename>
      <cvename>CVE-2025-14017</cvename>
      <cvename>CVE-2025-13034</cvename>
      <url>https://curl.se/docs/vuln-8.17.0.html</url>
    </references>
    <dates>
      <discovery>2026-01-06</discovery>
      <entry>2026-03-11</entry>
    </dates>
  </vuln>

  <vuln vid="1933737d-1d46-11f1-81da-8447094a420f">
    <topic>curl -- Multiple vulnerabilties</topic>
    <affects>
      <package>
	<name>curl</name>
	<range><lt>8.19.0</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The curl project reports:</p>
	<blockquote cite="https://curl.se/docs/vuln-8.18.0.html">
	  <ul>
	    <li>use after free in SMB connection reuse</li>
	    <li>wrong proxy connection reuse with credentials</li>
	    <li>token leak with redirect and netrc</li>
	    <li>bad reuse of HTTP Negotiate connection</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-3805</cvename>
      <cvename>CVE-2026-3784</cvename>
      <cvename>CVE-2026-3783</cvename>
      <cvename>CVE-2026-1965</cvename>
      <url>https://curl.se/docs/vuln-8.18.0.html</url>
    </references>
    <dates>
      <discovery>2026-03-11</discovery>
      <entry>2026-03-11</entry>
    </dates>
  </vuln>

  <vuln vid="791d4b29-19fb-11f1-87cc-e73692421fef">
    <topic>gstreamer1 -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>gstreamer1</name>
	<range><lt>1.28.1</lt></range>
      </package>
      <package>
	<name>gstreamer1-plugins</name>
	<range><lt>1.28.1</lt></range>
      </package>
      <package>
	<name>gstreamer1-plugins-good</name>
	<range><lt>1.28.1</lt></range>
      </package>
      <package>
	<name>gstreamer1-plugins-bad</name>
	<range><lt>1.28.1</lt></range>
      </package>
      <package>
	<name>gstreamer1-plugins-ugly</name>
	<range><lt>1.28.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GStreamer project reports multiple security vulnerabilities fixed in the 1.28.1 release:</p>
	<blockquote cite="https://gstreamer.freedesktop.org/security/">
	  <p>Twelve security vulnerabilities were addressed, including:</p>
	  <ul>
	    <li>Out-of-bounds reads and writes in the H.266 video parser, WAV parser,
	    MP4 and ASF demuxers, and DVB subtitle decoder.</li>
	    <li>Integer overflows in the RIFF parser and Huffman table handling in the JPEG parser.</li>
	    <li>Stack buffer overflows in the RTP QDM2 depayloader and H.266 parser.</li>
	  </ul>
	  <p>These could lead to application crashes or potentially arbitrary code execution.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-1940</cvename>
      <cvename>CVE-2026-3082</cvename>
      <cvename>CVE-2026-2921</cvename>
      <cvename>CVE-2026-2922</cvename>
      <cvename>CVE-2026-2920</cvename>
      <cvename>CVE-2026-2923</cvename>
      <cvename>CVE-2026-3083</cvename>
      <cvename>CVE-2026-3085</cvename>
      <cvename>CVE-2026-3086</cvename>
      <cvename>CVE-2026-3081</cvename>
      <cvename>CVE-2026-3084</cvename>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0001.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0002.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0003.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0004.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0005.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0006.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0007.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0008.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0009.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0010.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0011.html</url>
      <url>https://gstreamer.freedesktop.org/security/sa-2026-0012.html</url>
    </references>
    <dates>
      <discovery>2026-02-25</discovery>
      <entry>2026-03-07</entry>
    </dates>
  </vuln>

  <vuln vid="10319b08-f050-4beb-95e3-fe025cdafd25">
    <topic>oauth2-proxy -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>oauth2-proxy</name>
	<range><lt>7.14.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-68121</cvename>
    </references>
    <dates>
      <discovery>2026-02-05</discovery>
      <entry>2026-02-27</entry>
    </dates>
  </vuln>

  <vuln vid="15f4e0f6-1338-11f1-a55d-b42e991fc52e">
    <topic>Mozilla -- Multiple vulnerabilities</topic>
    <affects>
      <package>
      <name>firefox</name>
      <range><lt>148.0.0,2</lt></range>
      </package>
      <package>
      <name>firefox-esr</name>
      <range><lt>140.8.0</lt></range>
      </package>
      <package>
      <name>thunderbird</name>
      <range><lt>148.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-2809: Memory safety bug in the JavaScript: WebAssembly component.</p>
	<p>CVE-2026-2808: Integer overflow in the JavaScript: Standard Library component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-2809</cvename>
      <cvename>CVE-2026-2808</cvename>
    </references>
    <dates>
      <discovery>2026-02-24</discovery>
      <entry>2026-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="1124a7b0-1338-11f1-a55d-b42e991fc52e">
    <topic>Firefox -- Multiple vulnerabilities</topic>
    <affects>
      <package>
      <name>firefox</name>
      <range><lt>148.0.0,2</lt></range>
      </package>
      <package>
      <name>thunderbird</name>
      <range><lt>148.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>CVE-2026-2807: Memory safety bugs present in Firefox 147 and Thunderbird 147</p>
	<p>CVE-2026-2806: Uninitialized memory in the Graphics: Text component.</p>
	<p>CVE-2026-2805: Invalid pointer in the DOM: Core &amp; HTML component.</p>
	<p>CVE-2026-2804: Use-after-free in the JavaScript: WebAssembly component.</p>
	<p>CVE-2026-2803: Information disclosure, mitigation bypass in the Settings
      UI component.</p>
	<p>CVE-2026-2802: Race condition in the JavaScript: GC component.</p>
	<p>CVE-2026-2801: Incorrect boundary conditions in the JavaScript:
      WebAssembly component.</p>
	<p>CVE-2026-2799: Use-after-free in the DOM: Core &amp; HTML component.</p>
	<p>CVE-2026-2798: Use-after-free in the DOM: Core &amp; HTML component.</p>
	<p>CVE-2026-2797: Use-after-free in the JavaScript: GC component.</p>
	<p>CVE-2026-2796: JIT miscompilation in the JavaScript: WebAssembly component</p>
	<p>CVE-2026-2795: Use-after-free in the JavaScript: GC component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-2807</cvename>
      <cvename>CVE-2026-2806</cvename>
      <cvename>CVE-2026-2805</cvename>
      <cvename>CVE-2026-2804</cvename>
      <cvename>CVE-2026-2803</cvename>
      <cvename>CVE-2026-2802</cvename>
      <cvename>CVE-2026-2801</cvename>
      <cvename>CVE-2026-2799</cvename>
      <cvename>CVE-2026-2798</cvename>
      <cvename>CVE-2026-2797</cvename>
      <cvename>CVE-2026-2796</cvename>
      <cvename>CVE-2026-2795</cvename>
    </references>
    <dates>
      <discovery>2026-02-24</discovery>
      <entry>2026-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="102a03c9-1316-11f1-93ca-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.9.0</ge><lt>18.9.1</lt></range>
<range><ge>18.8.0</ge><lt>18.8.5</lt></range>
<range><ge>9.0.0</ge><lt>18.7.5</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/">
	  <p>Cross-site Scripting issue in Mermaid sandbox impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in container registry impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Jira events endpoint impacts GitLab CE/EE</p>
	  <p>Regular Expression Denial of Service issue in GitLab merge requests impacts GitLab CE/EE</p>
	  <p>Missing rate limit in Bitbucket Server importer impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in CI trigger API impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in token decoder impacts GitLab CE/EE</p>
	  <p>Improper Access Control issue in Conan package registry impacts GitLab EE</p>
	  <p>Access Control issue in CI job mutation impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-0752</cvename>
      <cvename>CVE-2025-14511</cvename>
      <cvename>CVE-2026-1662</cvename>
      <cvename>CVE-2026-1388</cvename>
      <cvename>CVE-2026-2845</cvename>
      <cvename>CVE-2025-3525</cvename>
      <cvename>CVE-2026-1725</cvename>
      <cvename>CVE-2026-1747</cvename>
      <cvename>CVE-2025-14103</cvename>
      <url>https://about.gitlab.com/releases/2026/02/25/patch-release-gitlab-18-9-1-released/</url>
    </references>
    <dates>
      <discovery>2026-02-25</discovery>
      <entry>2026-02-26</entry>
    </dates>
  </vuln>

  <vuln vid="fe6209a3-126c-11f1-8a62-0897988a1c07">
    <topic>mail/mailpit -- Server-Side Request Forgery (SSRF) via Link Check API</topic>
    <affects>
      <package>
	<name>mailpit</name>
	<range><lt>1.29.2</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mailpit author reports:</p>
	<blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3">
	  <p>The Link Check API (/api/v1/message/{ID}/link-check)
	  is vulnerable to Server-Side Request Forgery (SSRF). The
	  server performs HTTP HEAD requests to every URL found in
	  an email without validating target hosts or filtering
	  private/internal IP addresses. The response returns status
	  codes and status text per link, making this a non-blind
	  SSRF. In the default configuration (no authentication on
	  SMTP or API), this is fully exploitable remotely with
	  zero user interaction.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-27808</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-mpf7-p9x7-96r3</url>
    </references>
    <dates>
      <discovery>2026-02-25</discovery>
      <entry>2026-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="fbc47390-11e9-11f1-8148-bc241121aa0a">
    <topic>FreeBSD -- Local DoS and possible privilege escalation via routing sockets</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>15.0</ge><lt>15.0_4</lt></range>
	<range><ge>14.3</ge><lt>14.3_9</lt></range>
	<range><ge>13.5</ge><lt>13.5_10</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>The rtsock_msg_buffer() function serializes routing information
	into a buffer.  As a part of this, it copies sockaddr structures
	into a sockaddr_storage structure on the stack.  It assumes that
	the source sockaddr length field had already been validated, but
	this is not necessarily the case, and it's possible for a malicious
	userspace program to craft a request which triggers a 127-byte
	overflow.</p>
	<p>In practice, this overflow immediately overwrites the canary for
	the rtsock_msg_buffer() stack frame, resulting in a panic once the
	function returns.</p>
	<h1>Impact:</h1>
	<p>The bug allows an unprivileged user to crash the kernel by
	triggering a stack buffer overflow in rtsock_msg_buffer().  In
	particular, the overflow will corrupt a stack canary value that is
	verified when the function returns; this mitigates the impact of
	the stack overflow by triggering a kernel panic.</p>
	<p>Other kernel bugs may exist which allow userspace to find the canary
	value and thus defeat the mitigation, at which point local privilege
	escalation may be possible.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-3038</cvename>
      <freebsdsa>SA-26:05.route</freebsdsa>
    </references>
    <dates>
      <discovery>2026-02-24</discovery>
      <entry>2026-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="a88f5b2d-11e9-11f1-8148-bc241121aa0a">
    <topic>FreeBSD -- Jail chroot escape via fd exchange with a different jail</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.3</ge><lt>14.3_9</lt></range>
	<range><ge>13.5</ge><lt>13.5_10</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>If two sibling jails are restricted to separate filesystem
	trees, which is to say that neither of the two jail root directories
	is an ancestor of the other, jailed processes may nonetheless be
	able to access a shared directory via a nullfs mount, if the
	administrator has configured one.</p>
	<p>In this case, cooperating processes in the two jails may establish
	a connection using a unix domain socket and exchange directory
	descriptors with each other.</p>
	<p>When performing a filesystem name lookup, at each step of the lookup,
	the kernel checks whether the lookup would descend below the jail
	root of the current process.  If the jail root directory is not
	encountered, the lookup continues.</p>
	<h1>Impact:</h1>
	<p>In a configuration where processes in two different jails are
	able to exchange file descriptors using a unix domain socket, it
	is possible for a jailed process to receive a directory for a
	descriptor that is below that process' jail root.  This enables
	full filesystem access for a jailed process, breaking the chroot.</p>
	<p>Note that the system administrator is still responsible for ensuring
	that an unprivileged user on the jail host is not able to pass
	directory descriptors to a jailed process, even in a patched
	kernel.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-15576</cvename>
      <freebsdsa>SA-26:04.jail</freebsdsa>
    </references>
    <dates>
      <discovery>2026-02-24</discovery>
      <entry>2026-02-25</entry>
    </dates>
  </vuln>

  <vuln vid="4594110e-1151-11f1-b3f8-8447094a420f">
    <topic>Vaultwarden -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>vaultwarden</name>
	<range><lt>1.35.4</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Vaultwarden project reports:</p>
	<blockquote cite="https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4">
	  <ul>
	    <li>GHSA-w9f8-m526-h7fh. This vulnerability would allow an attacker to access a cipher from a different user (fully encrypted) if they already know its internal UUID.</li>
	    <li>GHSA-h4hq-rgvh-wh27. This vulnerability allows an attacker with manager-level access within an organization to modify collections they can access, even if they do not have management permissions for them.</li>
	    <li>GHSA-r32r-j5jq-3w4m. This vulnerability allows an attacker with manager-level access within an organization to modify collections they are not assigned.</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/dani-garcia/vaultwarden/releases/tag/1.35.4</url>
    </references>
    <dates>
      <discovery>2026-02-23</discovery>
      <entry>2026-02-24</entry>
    </dates>
  </vuln>

  <vuln vid="716d25a6-0fdc-11f1-bfdf-ff9355aecb00">
    <topic>openexr -- buffer overflow in istream_nonparallel_read on invalid input data</topic>
    <affects>
      <package>
	<name>openexr</name>
	<range><lt>3.3.7</lt></range>
	<range><ge>3.4.0</ge><lt>3.4.5</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Cary Phillips reports:</p>
	<blockquote cite="https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5">
	  <p>[openexr] v3.4.5 [...] fixes an incorrect size check in istream_nonparallel_read that could lead to a buffer overflow on invalid input data.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <url>https://github.com/AcademySoftwareFoundation/openexr/releases/tag/v3.4.5</url>
      <url>https://github.com/AcademySoftwareFoundation/openexr/commit/6bb2ddf1068573d073edf81270a015b38cc05cef</url>
    </references>
    <dates>
      <discovery>2026-02-16</discovery>
      <entry>2026-02-22</entry>
    </dates>
  </vuln>

  <vuln vid="428e782a-0e92-11f1-a9b1-0cc47ada5f32">
    <topic>jenkins -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>jenkins</name>
	<range><lt>2.551</lt></range>
      </package>
      <package>
	<name>jenkins-lts</name>
	<range><lt>2.541.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Jenkins Security Advisory:</p>
	<blockquote cite="https://www.jenkins.io/security/advisory/2026-02-18/">
	  <h1>Description</h1>
	  <h5>(High) SECURITY-3669 / CVE-2026-27099</h5>
	  <p>Stored XSS vulnerability in node offline cause description</p>
	  <h5>(Medium) SECURITY-3658 / CVE-2026-27100</h5>
	  <p>Build information disclosure vulnerability through Run Parameter</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-27099</cvename>
      <cvename>CVE-2026-27100</cvename>
      <url>https://www.jenkins.io/security/advisory/2026-02-18/</url>
    </references>
    <dates>
      <discovery>2026-02-18</discovery>
      <entry>2026-02-20</entry>
    </dates>
  </vuln>

  <vuln vid="6a81dc74-0e8b-11f1-b7d1-b42e991fc52e">
    <topic>Mozilla -- Heap buffer overflow</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>147.0.4,2</lt></range>
    </package>
    <package>
	<name>firefox-esr</name>
	<range><lt>140.7.1</lt></range>
    </package>
    <package>
	<name>thunderbird</name>
	<range><lt>147.0.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2014390 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2014390">
	  <p>Heap buffer overflow in libvpx.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-2447</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-2447</url>
    </references>
    <dates>
      <discovery>2026-02-16</discovery>
      <entry>2026-02-20</entry>
    </dates>
  </vuln>

  <vuln vid="a977cb1c-0d7d-11f1-85c5-a8a1599412c6">
    <topic>chromium -- security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>145.0.7632.109</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>145.0.7632.109</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_18.html">
	 <p>This update includes 3 security fixes:</p>
	 <ul>
	    <li>[477033835] High CVE-2026-2648: Heap buffer overflow in PDFium. Reported by soiax on 2026-01-19</li>
	    <li>[481074858] High CVE-2026-2649: Integer overflow in V8. Reported by JunYoung Park(@candymate) of KAIST Hacking Lab on 2026-02-03</li>
	    <li>[476461867] Medium CVE-2026-2650: Heap buffer overflow in Media. Reported by Google on 2026-01-18</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-2648</cvename>
      <cvename>CVE-2026-2649</cvename>
      <cvename>CVE-2026-2650</cvename>
      <url>https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_18.html</url>
    </references>
    <dates>
      <discovery>2026-02-18</discovery>
      <entry>2026-02-19</entry>
    </dates>
  </vuln>

  <vuln vid="67793feb-0b5b-11f1-a1c0-0050569f0b83">
    <topic>powerdns-recursor -- Denial of Service</topic>
    <affects>
    <package>
	<name>powerdns-recursor</name>
	<range><lt>5.3.5</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>PowerDNS Team reports:</p>
	<blockquote cite="https://blog.powerdns.com/2025/12/08/powerdns-security-advisories-2025-07-and-2025-08">
	<p>2025-07: Internal logic flaw in cache management can lead to
	a denial of service in Recursor</p>
	<p>2025-08: Insufficient validation of incoming notifies over
	TCP can lead to a denial of service in Recursor</p>
	<p>2026-01: Crafted zones can lead to increased resource usage in Recursor</p>
	<p>2026-01: This problem can be triggered by publishing and querying a crafted
	zone that causes large memory usage.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-59029</cvename>
      <cvename>CVE-2025-59030</cvename>
      <cvename>CVE-2026-24027</cvename>
      <cvename>CVE-2026-0398</cvename>
      <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-07.html</url>
      <url>https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2025-08.html</url>
      <url>https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-01.html</url>
    </references>
    <dates>
      <discovery>2025-12-08</discovery>
      <entry>2026-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="f9cb72e4-0b52-11f1-8e75-b42e991fc52e">
    <topic>png -- CWE-122: Heap-based Buffer Overflow</topic>
    <affects>
    <package>
	<name>png</name>
	<range><lt>1.6.55</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3 reports:</p>
	<blockquote cite="https://github.com/pnggroup/libpng/security/advisories/GHSA-g8hp-mq4h-rqm3">
	  <p>LIBPNG is a reference library for use in applications
	  that read, create, and manipulate PNG (Portable Network
	  Graphics) raster image files.  Prior to 1.6.55, an
	  out-of-bounds read vulnerability exists in the
	  png_set_quantize() API function.  When the function is
	  called with no histogram and the number of colors in the
	  palette is more than twice the maximum supported by the
	  user's display, certain palettes will cause the function to
	  enter into an infinite loop that reads past the end of an
	  internal heap-allocated buffer.  The images that trigger
	  this vulnerability are valid per the PNG specification.
	  This vulnerability is fixed in 1.6.55.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-25646</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-25646</url>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-16</entry>
    </dates>
  </vuln>

  <vuln vid="590979aa-09f7-11f1-a730-5404a68ad561">
    <topic>traefik -- TCP readTimeout bypass via STARTTLS on Postgres</topic>
    <affects>
    <package>
	<name>traefik</name>
	<range><lt>3.6.8</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The traefik project reports:</p>
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-89p3-4642-cr2w">
	  <p>There is a potential vulnerability in Traefik managing STARTTLS requests.
	     An unauthenticated client can bypass Traefik entrypoint respondingTimeouts.readTimeout
	     by sending the 8-byte Postgres SSLRequest (STARTTLS) prelude and then stalling,
	     causing connections to remain open indefinitely, leading to a denial of service</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-25949</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-25949</url>
    </references>
    <dates>
      <discovery>2026-02-11</discovery>
      <entry>2026-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="17186409-09d2-11f1-a39c-b42e991fc52e">
    <topic>munge -- CWE-787: Out-of-bounds Write</topic>
    <affects>
    <package>
	<name>munge</name>
	<range><lt>0.5.18</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh reports:</p>
	<blockquote cite="https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh">
	  <p>MUNGE is an authentication service for creating and
	  validating user credentials.  From 0.5 to 0.5.17, local
	  attacker can exploit a buffer overflow vulnerability in
	  munged (the MUNGE authentication daemon) to leak
	  cryptographic key material from process memory.  With the
	  leaked key material, the attacker could forge arbitrary
	  MUNGE credentials to impersonate any user (including root)
	  to services that rely on MUNGE for authentication.  The
	  vulnerability allows a buffer overflow by sending a crafted
	  message with an oversized address length field, corrupting
	  munged's internal state and enabling extraction of the MAC
	  subkey used for credential verification.  This vulnerability
	  is fixed in 0.5.18.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-25506</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-25506</url>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="424d598b-09c4-11f1-85c5-a8a1599412c6">
    <topic>chromium -- security fix</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>145.0.7632.75</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>145.0.7632.75</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html">
	 <p>This update includes 1 security fix:</p>
	 <ul>
	    <li>[483569511] High CVE-2026-2441: Use after free in CSS. Reported by Shaheen Fazim on 2026-02-11</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-2441</cvename>
      <url>https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop_13.html</url>
    </references>
    <dates>
      <discovery>2026-02-13</discovery>
      <entry>2026-02-14</entry>
    </dates>
  </vuln>

  <vuln vid="027c6c07-065b-11f1-baae-589cfc023192">
    <topic>expat -- multiple vulnerabilities</topic>
    <affects>
      <package>
       <name>expat</name>
       <range><lt>2.7.4</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
      <p>expat team reports:</p>
      <blockquote cite="https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes">
       <p>Update contains 2 security fixes:</p>
       <ul>
       <li>CVE-2026-24515: NULL dereference in function XML_ExternalEntityParserCreate</li>
       <li>CVE-2026-25210: missing check for integer overflow in function doContent</li>
       </ul>
      </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-24515</cvename>
      <cvename>CVE-2026-25210</cvename>
    </references>
    <dates>
      <discovery>2026-01-31</discovery>
      <entry>2026-02-10</entry>
    </dates>
  </vuln>

  <vuln vid="e3afc190-0821-11f1-a857-6cc21735f730">
    <topic>PostgreSQL -- Multiple vulnerabilities</topic>
    <affects>
      <package>
       <name>postgresql14-server</name>
       <range><lt>14.21</lt></range>
      </package>
      <package>
       <name>postgresql15-server</name>
       <range><lt>15.16</lt></range>
      </package>
      <package>
       <name>postgresql16-server</name>
       <range><lt>16.12</lt></range>
      </package>
      <package>
       <name>postgresql17-server</name>
       <range><lt>17.8</lt></range>
      </package>
      <package>
       <name>postgresql18-server</name>
       <range><lt>18.2</lt></range>
      </package>
      <package>
       <name>postgresql14-server</name>
       <range><lt>14.21</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The PostgreSQL project reports:</p>
	<blockquote cite="https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/">
	<p>
	  Improper validation of type oidvector in PostgreSQL
	  allows a database user to disclose a few bytes of server
	  memory. We have not ruled out viability of attacks that
	  arrange for presence of confidential information in
	  disclosed bytes, but they seem unlikely.
	</p>
	<p>
	  Missing validation of type of input in PostgreSQL
	  intarray extension selectivity estimator function allows
	  an object creator to execute arbitrary code as the
	  operating system user running the database.
	</p>
	<p>
	  Heap buffer overflow in PostgreSQL pgcrypto allows a
	  ciphertext provider to execute arbitrary code as the
	  operating system user running the database.
	</p>
	<p>
	  Missing validation of multibyte character length in
	  PostgreSQL text manipulation allows a database user to
	  issue crafted queries that achieve a buffer overrun.
	  That suffices to execute arbitrary code as the operating
	  system user running the database.
	</p>
	<p>
	  Heap buffer overflow in PostgreSQL pg_trgm allows a
	  database user to achieve unknown impacts via a crafted
	  input string. The attacker has limited control over the
	  byte patterns to be written, but we have not ruled out
	  the viability of attacks that lead to privilege
	  escalation.
	</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-2003</cvename>
      <cvename>CVE-2026-2004</cvename>
      <cvename>CVE-2026-2005</cvename>
      <cvename>CVE-2026-2006</cvename>
      <cvename>CVE-2026-2007</cvename>
      <url>https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/</url>
    </references>
    <dates>
      <discovery>2026-02-12</discovery>
      <entry>2026-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="7f9bac32-0800-11f1-8a6f-b42e991fc52e">
    <topic>MongoDB Server -- CWE-704 Incorrect Type Conversion or Cast</topic>
    <affects>
    <package>
	<name>mongodb70</name>
	<range><lt>7.0.29</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://jira.mongodb.org/browse/SERVER-113685 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-113685">
	  <p>An authorized user may disable the MongoDB server by
	  issuing a query against a collection that contains an
	  invalid compound wildcard index.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-25613</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-25613</url>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="7b5671f9-0800-11f1-8a6f-b42e991fc52e">
    <topic>MongoDB Server -- CWE-617 Reachable Assertion</topic>
    <affects>
    <package>
	<name>mongodb80</name>
	<range><lt>8.0.13</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://jira.mongodb.org/browse/SERVER-99119 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-99119">
	  <p>An authorized user may trigger a server crash by running
	  a $geoNear pipeline with certain invalid index hints.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-25610</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-25610</url>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="77e32b14-0800-11f1-8a6f-b42e991fc52e">
    <topic>MongoDB Server -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mongodb80</name>
	<range><lt>8.0.18</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://jira.mongodb.org/browse/SERVER-114126 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-114126">
	  <p>Complex queries can cause excessive memory usage in
	  MongoDB Query Planner resulting in an Out-Of-Memory
	    Crash.</p>
	</blockquote>
	<p>https://jira.mongodb.org/browse/SERVER-102364 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-102364">
	  <p>MongoDB Server may experience an out-of-memory failure while
	  evaluating expressions that produce deeply nested documents. The
	  issue arises in recursive functions because the server does not
	    periodically check the depth of the expression.</p>
	</blockquote>
	<p>https://jira.mongodb.org/browse/SERVER-113532 reports:</p>
	<blockquote cite="https://jira.mongodb.org/browse/SERVER-113532">
	  <p>Inserting certain large documents into a replica set could lead to
	  replica set secondaries not being able to fetch the oplog from the
	  primary. This could stall replication inside the replica set leading
	    to server crash.</p>
	</blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-1850</cvename>
      <cvename>CVE-2026-1849</cvename>
      <cvename>CVE-2026-1847</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-1850</url>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-1849</url>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-1847</url>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-12</entry>
    </dates>
  </vuln>

  <vuln vid="9d9940e7-071c-11f1-93ca-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.8.0</ge><lt>18.8.4</lt></range>
<range><ge>18.7.0</ge><lt>18.7.4</lt></range>
<range><ge>8.0.0</ge><lt>18.6.6</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/">
	  <p>Incomplete Validation issue in Web IDE impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in GraphQL introspection impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in JSON validation middleware impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in Code Flow impacts GitLab CE/EE</p>
	  <p>HTML Injection issue in test case titles impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Markdown processor impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in Markdown Preview impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in dashboard impacts GitLab EE</p>
	  <p>Server-Side Request Forgery issue in Virtual Registry impacts GitLab EE</p>
	  <p>Improper Validation issue in diff parser impacts GitLab CE/EE</p>
	  <p>Server-Side Request Forgery issue in Git repository import impacts GitLab CE/EE</p>
	  <p>Authorization Bypass issue in iterations API impacts GitLab EE</p>
	  <p>Missing Authorization issue in GLQL API impacts GitLab CE/EE</p>
	  <p>Stored HTML Injection issue in project label impacts GitLab CE/EE</p>
	  <p>Authorization Bypass issue in Pipeline Schedules API impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-7659</cvename>
      <cvename>CVE-2025-8099</cvename>
      <cvename>CVE-2026-0958</cvename>
      <cvename>CVE-2025-14560</cvename>
      <cvename>CVE-2026-0595</cvename>
      <cvename>CVE-2026-1458</cvename>
      <cvename>CVE-2026-1456</cvename>
      <cvename>CVE-2026-1387</cvename>
      <cvename>CVE-2025-12575</cvename>
      <cvename>CVE-2026-1094</cvename>
      <cvename>CVE-2025-12073</cvename>
      <cvename>CVE-2026-1080</cvename>
      <cvename>CVE-2025-14592</cvename>
      <cvename>CVE-2026-1282</cvename>
      <cvename>CVE-2025-14594</cvename>
      <url>https://about.gitlab.com/releases/2026/02/10/patch-release-gitlab-18-8-4-released/</url>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-11</entry>
    </dates>
  </vuln>

  <vuln vid="8d8012e5-0705-11f1-8148-bc241121aa0a">
    <topic>FreeBSD -- blocklistd(8) socket leak</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_3</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	<p>Due to a programming error, blocklistd leaks a socket descriptor
	for each adverse event report it receives.</p>
	<p>Once a certain number of leaked sockets is reached, blocklistd
	becomes unable to run the helper script: a child process is forked,
	but this child dereferences a null pointer and crashes before it
	is able to exec the helper.  At this point, blocklistd still records
	adverse events but is unable to block new addresses or unblock
	addresses whose database entries have expired.</p>
	<p>Once a second, much higher number of leaked sockets is reached,
	blocklistd becomes unable to receive new adverse event reports.</p>
	<h1>Impact:</h1>
	<p>An attacker may take advantage of this by triggering a large
	number of adverse events from sacrificial IP addresses to effectively
	disable blocklistd before launching an attack.</p>
	<p>Even in the absence of attacks or probes by would-be attackers,
	adverse events will occur regularly in the course of normal operations,
	and blocklistd will gradually run out file descriptors and become
	ineffective.</p>
	<p>The accumulation of open sockets may have knock-on effects on other
	parts of the system, resulting in a general slowdown until blocklistd
	is restarted.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-2261</cvename>
      <freebsdsa>SA-26:03.blocklistd</freebsdsa>
    </references>
    <dates>
      <discovery>2026-02-10</discovery>
      <entry>2026-02-11</entry>
    </dates>
  </vuln>

  <vuln vid="9bc5a730-0585-11f1-85c5-a8a1599412c6">
    <topic>chromium -- multiple security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>144.0.7559.132</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>144.0.7559.132</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html">
	 <p>This update includes 2 security fixes:</p>
	 <ul>
	    <li>[478942410] High CVE-2026-1861: Heap buffer overflow in libvpx. Reported by Google on 2026-01-26</li>
	    <li>[479726070] High CVE-2026-1862: Type Confusion in V8. Reported by Chaoyuan Peng (@ret2happy) on 2026-01-29</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-1861</cvename>
      <cvename>CVE-2026-1862</cvename>
      <url>https://chromereleases.googleblog.com/2026/02/stable-channel-update-for-desktop.html</url>
    </references>
    <dates>
      <discovery>2026-02-03</discovery>
      <entry>2026-02-09</entry>
    </dates>
  </vuln>

  <vuln vid="f301a241-04d3-11f1-a38c-8447094a420f">
    <topic>Roundcube -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>roundcube-php82</name>
	<name>roundcube-php83</name>
	<name>roundcube-php84</name>
	<name>roundcube-php85</name>
	<range><lt>1.6.13,1</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Roundcube project reports:</p>
	<blockquote cite="https://github.com/roundcube/roundcubemail/releases/tag/1.6.13">
	  <p>Unspecified CSS injection vulnerability.</p>
	  <p>Remote image blocking bypass via SVG content.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/roundcube/roundcubemail/releases/tag/1.6.13</url>
    </references>
    <dates>
      <discovery>2026-02-08</discovery>
      <entry>2026-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="73ff246b-04b2-11f1-84fc-4ccc6adda413">
    <topic>qt6-webengine -- multiple vulnerabilities</topic>
    <affects>
<package>
<name>qt6-pdf</name>
<name>qt6-webengine</name>
<range><lt>6.10.2</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Qt qtwebengine-chromium repo reports:</p>
	<blockquote cite="https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=134-based">
	  <p>Backports for 7 security bugs in Chromium:</p>
	  <ul>
	    <li>CVE-2025-13638: Prevent media element GC in callbacks in WebMediaPlayerMS</li>
	    <li>CVE-2025-13639: Improve validation of SDP direction in remote description</li>
	    <li>CVE-2025-13720: Avoid downcasting Hash and Integrity reports</li>
	    <li>CVE-2025-14174: Metal: Don't use pixelsDepthPitch to size buffers</li>
	    <li>CVE-2025-14765: Polyfill unary negation and abs for amd mesa frontend</li>
	    <li>CVE-2026-0908: Use CheckedNumerics in HandleAllocator</li>
	    <li>CVE-2026-1504: Block opaque 416 responses to non-range requests</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-13638</cvename>
      <cvename>CVE-2025-13639</cvename>
      <cvename>CVE-2025-13720</cvename>
      <cvename>CVE-2025-14174</cvename>
      <cvename>CVE-2025-14765</cvename>
      <cvename>CVE-2026-0908</cvename>
      <cvename>CVE-2026-1504</cvename>
      <url>https://code.qt.io/cgit/qt/qtwebengine-chromium.git/log/?h=134-based</url>
    </references>
    <dates>
      <discovery>2026-02-02</discovery>
      <entry>2026-02-08</entry>
    </dates>
  </vuln>

  <vuln vid="a6effa17-1fd4-4895-8471-d5c684d7807c">
    <topic>navidrome -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>navidrome</name>
	<range><lt>0.60.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>An XSS vulnerability in the frontend allows a malicious attacker to inject code through the comment metadata of a song to exfiltrate user credentials.</p>
	<p>Authenticated users can crash the Navidrome server by supplying an excessively large size parameter to /rest/getCoverArt or to a shared-image URL (/share/img/{token}). When processing such requests, the server attempts to create an extremely large resized image, causing uncontrolled memory growth. This triggers the Linux OOM killer, terminates the Navidrome process, and results in a full service outage.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-25578</cvename>
      <url>https://github.com/navidrome/navidrome/security/advisories/GHSA-rh3r-8pxm-hg4w</url>
      <cvename>CVE-2026-25579</cvename>
      <url>https://github.com/navidrome/navidrome/security/advisories/GHSA-hrr4-3wgr-68x3</url>
    </references>
    <dates>
      <discovery>2026-02-03</discovery>
      <entry>2026-02-07</entry>
    </dates>
  </vuln>

  <vuln vid="1a82bf18-0417-11f1-be6f-5404a68ad561">
    <topic>traefik -- ACME TLS-ALPN fast path potential DoS</topic>
    <affects>
<package>
<name>traefik</name>
<range><lt>3.6.7</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The traefik project reports:</p>
	<blockquote cite="https://github.com/traefik/traefik/security/advisories/GHSA-cwjm-3f7h-9hwq">
	  <p>There is a potential vulnerability in Traefik ACME TLS certificates' automatic
	  generation: the ACME TLS-ALPN fast path can allow unauthenticated clients to
	  tie up goroutines and file descriptors indefinitely when the ACME TLS challenge
	  is enabled.A malicious client can open many connections, send a minimal ClientHello
	  with acme-tls/1, then stop responding, leading to denial of service of the entrypoint.
	  </p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-22045</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-22045</url>
    </references>
    <dates>
      <discovery>2026-01-15</discovery>
      <entry>2026-02-07</entry>
    </dates>
  </vuln>

  <vuln vid="bfe9adc8-0224-11f1-8790-c5fb948922ad">
    <topic>python -- several security vulnerabilities</topic>
    <affects>
      <package><name>python310</name> <range><lt>3.10.19_2</lt></range></package>
      <package><name>python311</name> <range><lt>3.11.14_2</lt></range></package>
      <package><name>python312</name> <range><lt>3.12.12_4</lt></range></package>
      <package><name>python313</name> <range><lt>3.13.12</lt></range></package>
      <package><name>python313t</name> <range><lt>3.13.12</lt></range></package>
      <package><name>python314</name> <range><lt>3.14.3</lt></range></package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The Python project announces a new release with several security fixes:</p>
	<blockquote cite="https://docs.python.org/release/3.14.3/whatsnew/changelog.html">
	  <ul>
	    <li>CVE-2026-1299: gh-144125: BytesGenerator will now refuse to serialize (write) headers that are unsafely folded or delimited; see verify_generated_headers. (Contributed by Bas Bloemsaat and Petr Viktorin in gh-121650).</li>
	    <li>gh-143935: Fixed a bug in the folding of comments when flattening an email message using a modern email policy. Comments consisting of a very long sequence of non-foldable characters could trigger a forced line wrap that omitted the required leading space on the continuation line, causing the remainder of the comment to be interpreted as a new header field. This enabled header injection with carefully crafted inputs.</li>
	    <li>gh-143925: Reject control characters in data: URL media types.</li>
	    <li>gh-143919: Reject control characters in http.cookies.Morsel fields and values.</li>
	    <li>CVE-2026-0865: gh-143916: Reject C0 control characters within wsgiref.headers.Headers fields, values, and parameters.</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-1299</cvename>
      <cvename>CVE-2026-0865</cvename>
      <url>https://docs.python.org/release/3.14.3/whatsnew/changelog.html</url>
    </references>
    <dates>
      <discovery>2026-01-16</discovery>
      <entry>2026-02-04</entry>
      <modified>2026-03-03</modified>
    </dates>
  </vuln>

  <vuln vid="232e16cc-fd83-11f0-981a-98b78501ef2a">
    <topic>xrdp -- remote code execution</topic>
    <affects>
<package>
<name>xrdp</name>
<range><lt>0.10.5</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Denis Skvortsov, Security Researcher at Kaspersky reports:</p>
	<blockquote cite="https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-rwvg-gp87-gh6f">
	  <p>xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bounds checking when processing user domain information during the connection sequence. If exploited, the vulnerability could allow remote attackers to execute arbitrary code on the target system.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-68670</cvename>
      <url>https://www.cve.org/CVERecord?id=CVE-2025-68670</url>
    </references>
    <dates>
      <discovery>2025-12-06</discovery>
      <entry>2026-01-27</entry>
    </dates>
  </vuln>

  <vuln vid="8173e68a-88f3-4862-882c-6e58779d98e7">
    <topic>zeek -- potential DoS vulnerability</topic>
    <affects>
<package>
<name>zeek</name>
<range><lt>8.0.6</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Tim Wojtulewicz of Corelight reports:</p>
	<blockquote cite="https://github.com/zeek/zeek/releases/tag/v8.0.6">
	  <p>Zeek's HTTP analyzer can be tricked into interpreting
	  Transfer-Encoding or Content-Length headers set in MIME
	  entities within HTTP bodies and change the analyzer
	  behavior.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://github.com/zeek/zeek/releases/tag/v8.0.6</url>
    </references>
    <dates>
      <discovery>2026-01-29</discovery>
      <entry>2026-01-29</entry>
    </dates>
  </vuln>

  <vuln vid="409d70ab-fc23-11f0-85c5-a8a1599412c6">
    <topic>chromium -- security fix</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>144.0.7559.109</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>144.0.7559.109</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_27.html">
	 <p>This update includes 1 security fix:</p>
	 <ul>
	    <li>[474435504] High CVE-2026-1504: Inappropriate implementation in Background Fetch API. Reported by Luan Herrera (@lbherrera_) on 2026-01-09</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-1504</cvename>
      <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_27.html</url>
    </references>
    <dates>
      <discovery>2026-01-27</discovery>
      <entry>2026-01-28</entry>
    </dates>
  </vuln>

  <vuln vid="9dac4f05-fc65-11f0-96db-b42e991fc52e">
    <topic>Firefox -- Multiple vulnerabilities</topic>
    <affects>
    <package>
	<name>firefox</name>
	<range><lt>147.0.2,2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://bugzilla.mozilla.org/show_bug.cgi?id=2007302 reports:</p>
	<blockquote cite="https://bugzilla.mozilla.org/show_bug.cgi?id=2007302">
	  <p>Mitigation bypass in the Privacy: Anti-Tracking component.</p>
	  <p>Use-after-free in the Layout: Scrolling and Overflow component.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-24868</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-24868</url>
      <cvename>CVE-2026-24869</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-24869</url>
    </references>
    <dates>
      <discovery>2026-01-27</discovery>
      <entry>2026-01-28</entry>
    </dates>
  </vuln>

  <vuln vid="90071333-fbe5-11f0-a13f-bc241121aa0a">
    <topic>FreeBSD -- Jail escape by a privileged user via nullfs</topic>
    <affects>
      <package>
	<name>FreeBSD-kernel</name>
	<range><ge>14.3</ge><lt>14.3_8</lt></range>
	<range><ge>13.5</ge><lt>13.5_9</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<h1>Problem Description:</h1>
	  <p>By default, jailed processes cannot mount filesystems, including
	  nullfs(4).  However, the allow.mount.nullfs option enables mounting
	  nullfs filesystems, subject to privilege checks.</p>
	  <p>If a privileged user within a jail is able to nullfs-mount directories,
	  a limitation of the kernel's path lookup logic allows that user to
	  escape the jail's chroot, yielding access to the full filesystem
	  of the host or parent jail.</p>
	<h1>Impact:</h1>
	  <p>In a jail configured to allow nullfs(4) mounts from within the
	  jail, the jailed root user can escape the jail's filesystem root.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-15547</cvename>
      <freebsdsa>SA-26:02.jail</freebsdsa>
    </references>
    <dates>
      <discovery>2026-01-27</discovery>
      <entry>2026-01-28</entry>
    </dates>
  </vuln>

  <vuln vid="4b824428-fb93-11f0-b194-8447094a420f">
    <topic>OpenSSL -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>FreeBSD</name>
	<range><ge>15.0</ge><lt>15.0_2</lt></range>
	<range><ge>14.3</ge><lt>14.3_8</lt></range>
	<range><ge>13.5</ge><lt>13.5_9</lt></range>
      </package>
      <package>
	<name>openssl</name>
	<range><lt>3.0.19,1</lt></range>
      </package>
      <package>
	<name>openssl33</name>
	<range><lt>3.3.6</lt></range>
      </package>
      <package>
	<name>openssl34</name>
	<range><lt>3.4.4</lt></range>
      </package>
      <package>
	<name>openssl35</name>
	<range><lt>3.5.5</lt></range>
      </package>
      <package>
	<name>openssl36</name>
	<range><lt>3.6.1</lt></range>
      </package>
      <package>
	<name>openssl</name>
	<range><lt>3.0.19</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The OpenSSL project reports:</p>
	<blockquote cite="https://openssl-library.org/news/secadv/20260127.txt">
	  <ul>
	    <li>Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (CVE-2025-11187)</li>
	    <li>Stack buffer overflow in CMS AuthEnvelopedData parsing (CVE-2025-15467)</li>
	    <li>NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (CVE-2025-15468)</li>
	    <li>"openssl dgst" one-shot codepath silently truncates inputs >16MB (CVE-2025-15469)</li>
	    <li>TLS 1.3 CompressedCertificate excessive memory allocation (CVE-2025-66199)</li>
	    <li>Heap out-of-bounds write in BIO_f_linebuffer on short writes (CVE-2025-68160)</li>
	    <li>Unauthenticated/unencrypted trailing bytes with low-level OCB function calls (CVE-2025-69418)</li>
	    <li>Out of bounds write in PKCS12_get_friendlyname() UTF-8 conversion (CVE-2025-69419)</li>
	    <li>Missing ASN1_TYPE validation in TS_RESP_verify_response() function (CVE-2025-69420)</li>
	    <li>NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function (CVE-2025-69421)</li>
	    <li>Missing ASN1_TYPE validation in PKCS#12 parsing (CVE-2026-22795)</li>
	    <li>ASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() function (CVE-2026-22796)</li>
	  </ul>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-11187</cvename>
      <cvename>CVE-2025-15467</cvename>
      <cvename>CVE-2025-15468</cvename>
      <cvename>CVE-2025-15469</cvename>
      <cvename>CVE-2025-66199</cvename>
      <cvename>CVE-2025-68160</cvename>
      <cvename>CVE-2025-69418</cvename>
      <cvename>CVE-2025-69419</cvename>
      <cvename>CVE-2025-69420</cvename>
      <cvename>CVE-2025-69421</cvename>
      <cvename>CVE-2026-22795</cvename>
      <cvename>CVE-2026-22796</cvename>
      <url>https://openssl-library.org/news/secadv/20260127.txt</url>
      <freebsdsa>SA-26:01.openssl</freebsdsa>
    </references>
    <dates>
      <discovery>2026-01-27</discovery>
      <entry>2026-01-27</entry>
      <modified>2026-01-28</modified>
    </dates>
  </vuln>

  <vuln vid="ab01cb11-f911-11f0-b194-8447094a420f">
    <topic>MySQL -- Multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>mysql80-server</name>
	<range><lt>8.0.45</lt></range>
      </package>
      <package>
	<name>mysql84-server</name>
	<range><lt>8.4.8</lt></range>
      </package>
      <package>
	<name>mysql91-server</name>
	<range><lt>9.1.3</lt></range>
      </package>
      <package>
	<name>mysql94-server</name>
	<range><lt>9.4.3</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Oracle reports:</p>
	<blockquote cite="https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL">
	  <p>Oracle reports multiple vulnerabilities in its MySQL server products.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-21949</cvename>
      <cvename>CVE-2026-21950</cvename>
      <cvename>CVE-2026-21968</cvename>
      <cvename>CVE-2026-21929</cvename>
      <cvename>CVE-2026-21936</cvename>
      <cvename>CVE-2026-21937</cvename>
      <cvename>CVE-2026-21941</cvename>
      <cvename>CVE-2026-21948</cvename>
      <cvename>CVE-2026-21952</cvename>
      <cvename>CVE-2026-21964</cvename>
      <cvename>CVE-2026-21965</cvename>
      <url>https://www.oracle.com/security-alerts/cpujan2026.html#AppendixMSQL</url>
    </references>
    <dates>
      <discovery>2026-01-20</discovery>
      <entry>2026-01-24</entry>
    </dates>
  </vuln>

  <vuln vid="65439aa0-f77d-11f0-9821-b0416f0c4c67">
    <topic>wheel -- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')</topic>
    <affects>
    <package>
	<name>py310-wheel</name>
	<name>py311-wheel</name>
	<name>py312-wheel</name>
	<name>py313-wheel</name>
	<name>py313t-wheel</name>
	<name>py314-wheel</name>
	<range><lt>0.46.2</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx reports:</p>
	<blockquote cite="https://github.com/pypa/wheel/security/advisories/GHSA-8rrh-rw8j-w5fx">
	  <p>wheel is a command line tool for manipulating Python wheel files,
as defined in PEP 427.  In versions 0.46.1 and below, the unpack
function is vulnerable to file permission modification through
mishandling of file permissions after extraction.  The logic blindly
trusts the filename from the archive header for the chmod operation,
even though the extraction process itself might have sanitized the
path.  Attackers can craft a malicious wheel file that, when unpacked,
changes the permissions of critical system files (e.g., /etc/passwd,
SSH keys, config files), allowing for Privilege Escalation or
arbitrary code execution by modifying now-writable scripts.  This
issue has been fixed in version 0.46.2.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-24049</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-24049</url>
    </references>
    <dates>
      <discovery>2026-01-22</discovery>
      <entry>2026-01-22</entry>
    </dates>
  </vuln>

  <vuln vid="f8560c1b-f772-11f0-85c5-a8a1599412c6">
    <topic>chromium -- multiple security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>144.0.7559.96</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>144.0.7559.96</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_20.html">
	 <p>This update includes 1 security fix:</p>
	 <ul>
	    <li>[473851441] High CVE-2026-1220: Race in V8. Reported by @p1nky4745 on 2026-01-07</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-1220</cvename>
      <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_20.html</url>
    </references>
    <dates>
      <discovery>2026-01-20</discovery>
      <entry>2026-01-22</entry>
    </dates>
  </vuln>

  <vuln vid="61dc7f67-f6e5-11f0-b051-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
<package>
<name>gitlab-ce</name>
<name>gitlab-ee</name>
<range><ge>18.8.0</ge><lt>18.8.2</lt></range>
<range><ge>18.7.0</ge><lt>18.7.2</lt></range>
<range><ge>11.9.0</ge><lt>18.6.4</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/">
	  <p>Denial of Service issue in Jira Connect integration impacts GitLab CE/EE</p>
	  <p>Incorrect Authorization issue in Releases API impacts GitLab CE/EE</p>
	  <p>Unchecked Return Value issue in authentication services impacts GitLab CE/EE</p>
	  <p>Infinite Loop issue in Wiki redirects impacts GitLab CE/EE</p>
	  <p>Denial of Service issue in API endpoint impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-13927</cvename>
      <cvename>CVE-2025-13928</cvename>
      <cvename>CVE-2026-0723</cvename>
      <cvename>CVE-2025-13335</cvename>
      <cvename>CVE-2026-1102</cvename>
      <url>https://about.gitlab.com/releases/2026/01/21/patch-release-gitlab-18-8-2-released/</url>
    </references>
    <dates>
      <discovery>2026-01-21</discovery>
      <entry>2026-01-21</entry>
    </dates>
  </vuln>

  <vuln vid="01f34a27-f560-11f0-bbdc-10ffe07f9334">
    <topic>mail/mailpit -- multiple vulnerabilities</topic>
    <affects>
<package>
<name>mailpit</name>
<range><lt>1.28.3</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mailpit author reports:</p>
	<blockquote cite="https://github.com/axllent/mailpit/releases/tag/v1.28.3">
	  <p>Ensure SMTP TO &amp; FROM addresses are RFC 5322
	  compliant and prevent header injection (GHSA-54wq-72mp-cq7c)</p>
	  <p>Prevent Server-Side Request Forgery (SSRF) via HTML
	  Check API (GHSA-6jxm-fv7w-rw5j)</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-23829</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-54wq-72mp-cq7c</url>
      <cvename>CVE-2026-23845</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-6jxm-fv7w-rw5j</url>
    </references>
    <dates>
      <discovery>2026-01-18</discovery>
      <entry>2026-01-19</entry>
    </dates>
  </vuln>

  <vuln vid="fb561db9-0fc1-4d92-81a2-ee01839c9119">
    <topic>oauth2-proxy -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>oauth2-proxy</name>
	<range><lt>7.14.1</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.</p>
	<p>A flaw was found in the crypto/x509 package in the Go standard library. This vulnerability allows a certificate validation bypass via an excluded subdomain constraint in a certificated chain as it does not restrict the usage of wildcard SANs in the leaf certificate.</p>
	<p>SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.</p>
	<p>SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-61729</cvename>
      <cvename>CVE-2025-61727</cvename>
      <cvename>CVE-2025-47914</cvename>
      <cvename>CVE-2025-58181</cvename>
    </references>
    <dates>
      <discovery>2026-01-16</discovery>
      <entry>2026-01-18</entry>
    </dates>
  </vuln>

  <vuln vid="ff20d3a3-f211-11f0-9ca3-b42e991fc52e">
    <topic>Mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>147.0.0,2</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>147.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>
	Memory safety bugs present in Firefox 146 and Thunderbird
	146. Some of these bugs showed evidence of memory corruption
	and we presume that with enough effort some of these could
	have been exploited to run arbitrary code.
	</p>
	<p>Denial-of-service in the DOM: Service Workers component.</p>
	<p>Information disclosure in the XML component.</p>
	<p>Sandbox escape in the Messaging System component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-0892</cvename>
      <cvename>CVE-2026-0889</cvename>
      <cvename>CVE-2026-0888</cvename>
      <cvename>CVE-2026-0881</cvename>
    </references>
    <dates>
      <discovery>2026-01-13</discovery>
      <entry>2026-01-15</entry>
    </dates>
  </vuln>

  <vuln vid="085101eb-f212-11f0-9ca3-b42e991fc52e">
    <topic>Mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>147.0.0,2</lt></range>
      </package>
      <package>
	<name>firefox-esr</name>
	<range><lt>140.7.0</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>147</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Memory safety bugs present in firefox-esr 140.6,
	Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146.</p>
	<p>Spoofing issue in the DOM: Copy &amp; Paste and Drag &amp;
	Drop component.</p>
	<p>Clickjacking issue and information disclosure in the PDF
	Viewer component.</p>
	<p>Use-after-free in the JavaScript: GC component.</p>
	<p>Use-after-free in the JavaScript Engine component.</p>
	<p>Information disclosure in the Networking component.</p>
	<p>Sandbox escape due to incorrect boundary conditions in the
	Graphics: CanvasWebGL component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-0891</cvename>
      <cvename>CVE-2026-0890</cvename>
      <cvename>CVE-2026-0887</cvename>
      <cvename>CVE-2026-0885</cvename>
      <cvename>CVE-2026-0884</cvename>
      <cvename>CVE-2026-0883</cvename>
      <cvename>CVE-2026-0878</cvename>
    </references>
    <dates>
      <discovery>2026-01-13</discovery>
      <entry>2026-01-15</entry>
    </dates>
  </vuln>

  <vuln vid="06061c59-f212-11f0-9ca3-b42e991fc52e">
    <topic>Mozilla -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>firefox</name>
	<range><lt>147.0.0,2</lt></range>
      </package>
      <package>
	<name>firefox-esr</name>
	<range><lt>140.7</lt></range>
      </package>
      <package>
	<name>thunderbird</name>
	<range><lt>147.0.0</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Incorrect boundary conditions in the Graphics
	component.</p>
	<p>Use-after-free in the IPC component.</p>
	<p>Sandbox escape due to integer overflow in the Graphics
	component.</p>
	<p>Sandbox escape due to incorrect boundary conditions in the
	Graphics component.</p>
	<p>Mitigation bypass in the DOM: Security component.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-0886</cvename>
      <cvename>CVE-2026-0882</cvename>
      <cvename>CVE-2026-0880</cvename>
      <cvename>CVE-2026-0879</cvename>
      <cvename>CVE-2026-0877</cvename>
    </references>
    <dates>
      <discovery>2026-01-13</discovery>
      <entry>2026-01-15</entry>
    </dates>
  </vuln>

  <vuln vid="6f76a1db-f124-11f0-85c5-a8a1599412c6">
    <topic>chromium -- multiple security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>144.0.7559.59</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>144.0.7559.59</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html">
	 <p>This update includes 10 security fixes:</p>
	 <ul>
	    <li>[458914193] High CVE-2026-0899: Out of bounds memory access in V8. Reported by @p1nky4745 on 2025-11-08</li>
	    <li>[465730465] High CVE-2026-0900: Inappropriate implementation in V8. Reported by Google on 2025-12-03</li>
	    <li>[40057499] High CVE-2026-0901: Inappropriate implementation in Blink. Reported by Irvan Kurniawan (sourc7) on 2021-10-04</li>
	    <li>[469143679] Medium CVE-2026-0902: Inappropriate implementation in V8. Reported by 303f06e3 on 2025-12-16</li>
	    <li>[444803530] Medium CVE-2026-0903: Insufficient validation of untrusted input in Downloads. Reported by Azur on 2025-09-13</li>
	    <li>[452209495] Medium CVE-2026-0904: Incorrect security UI in Digital Credentials. Reported by Hafiizh on 2025-10-15</li>
	    <li>[465466773] Medium CVE-2026-0905: Insufficient policy enforcement in Network. Reported by Google on 2025-12-02</li>
	    <li>[467448811] Low CVE-2026-0906: Incorrect security UI. Reported by Khalil Zhani on 2025-12-10</li>
	    <li>[444653104] Low CVE-2026-0907: Incorrect security UI in Split View. Reported by Hafiizh on 2025-09-12</li>
	    <li>[452209503] Low CVE-2026-0908: Use after free in ANGLE. Reported by Glitchers BoB 14th. on 2025-10-15</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-0899</cvename>
      <cvename>CVE-2026-0900</cvename>
      <cvename>CVE-2026-0901</cvename>
      <cvename>CVE-2026-0902</cvename>
      <cvename>CVE-2026-0903</cvename>
      <cvename>CVE-2026-0904</cvename>
      <cvename>CVE-2026-0905</cvename>
      <cvename>CVE-2026-0906</cvename>
      <cvename>CVE-2026-0907</cvename>
      <cvename>CVE-2026-0908</cvename>
      <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop_13.html</url>
    </references>
    <dates>
      <discovery>2026-01-13</discovery>
      <entry>2026-01-15</entry>
    </dates>
  </vuln>

  <vuln vid="fd3855b8-efbc-11f0-9e3f-b0416f0c4c67">
    <topic>virtualenv -- CWE-59: Improper Link Resolution Before File Access ('Link Following')</topic>
    <affects>
    <package>
	<name>py310-virtualenv</name>
	<name>py311-virtualenv</name>
	<name>py312-virtualenv</name>
	<name>py313-virtualenv</name>
	<name>py313t-virtualenv</name>
	<name>py314-virtualenv</name>
	<range><lt>20.36.1</lt></range>
    </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986 reports:</p>
	<blockquote cite="https://github.com/pypa/virtualenv/security/advisories/GHSA-597g-3phw-6986">
	  <p>virtualenv is a tool for creating isolated virtual python environments.
Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use)
vulnerabilities in virtualenv allow local attackers to perform
symlink-based attacks on directory creation operations.  An attacker
with local access can exploit a race condition between directory
existence checks and creation to redirect virtualenv's app_data and
lock file operations to attacker-controlled locations.  This issue
has been patched in version 20.36.1.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-22702</cvename>
      <url>https://cveawg.mitre.org/api/cve/CVE-2026-22702</url>
    </references>
    <dates>
      <discovery>2026-01-10</discovery>
      <entry>2026-01-12</entry>
    </dates>
  </vuln>

  <vuln vid="7e63d0dd-eeff-11f0-b135-c01803b56cc4">
    <topic>libtasn1 -- Stack-based buffer overflow</topic>
    <affects>
<package>
<name>libtasn1</name>
<range><lt>4.21.0</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>oss-security@ list reports:</p>
	<blockquote cite="https://www.openwall.com/lists/oss-security/2026/01/08/5">
	<p>Stack-based buffer overflow in libtasn1 version: v4.20.0.
	The function fails to validate the size of input data resulting
	in a buffer overflow in asn1_expend_octet_string.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-13151</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-13151</url>
    </references>
    <dates>
      <discovery>2026-01-07</discovery>
      <entry>2026-01-11</entry>
    </dates>
  </vuln>

  <vuln vid="c9b610e9-eebc-11f0-b051-2cf05da270f3">
    <topic>Gitlab -- vulnerabilities</topic>
    <affects>
      <package>
	<name>gitlab-ce</name>
	<name>gitlab-ee</name>
	<range><ge>18.7.0</ge><lt>18.7.1</lt></range>
	<range><ge>18.6.0</ge><lt>18.6.3</lt></range>
	<range><ge>8.3.0</ge><lt>18.5.5</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Gitlab reports:</p>
	<blockquote cite="https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/">
	  <p>Stored Cross-site Scripting issue in GitLab Flavored Markdown placeholders impacts GitLab CE/EE</p>
	  <p>Cross-site Scripting issue in Web IDE impacts GitLab CE/EE</p>
	  <p>Missing Authorization issue in Duo Workflows API impacts GitLab EE</p>
	  <p>Missing Authorization issue in AI GraphQL mutation impacts GitLab EE</p>
	  <p>Denial of Service issue in import functionality impacts GitLab CE/EE</p>
	  <p>Insufficient Access Control Granularity issue in GraphQL runnerUpdate mutation impacts GitLab CE/EE</p>
	  <p>Information Disclosure issue in Mermaid diagram rendering impacts GitLab CE/EE</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-9222</cvename>
      <cvename>CVE-2025-13761</cvename>
      <cvename>CVE-2025-13772</cvename>
      <cvename>CVE-2025-13781</cvename>
      <cvename>CVE-2025-10569</cvename>
      <cvename>CVE-2025-11246</cvename>
      <cvename>CVE-2025-3950</cvename>
      <url>https://about.gitlab.com/releases/2026/01/07/patch-release-gitlab-18-7-1-released/</url>
    </references>
    <dates>
      <discovery>2026-01-07</discovery>
      <entry>2026-01-11</entry>
    </dates>
  </vuln>

  <vuln vid="d822839e-ee4f-11f0-b53e-0897988a1c07">
    <topic>mail/mailpit -- Cross-Site WebSocket Hijacking</topic>
    <affects>
<package>
<name>mailpit</name>
<range><lt>1.28.2</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mailpit author reports:</p>
	<blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm">
	  <p>The Mailpit WebSocket server is configured to accept
	  connections from any origin. This lack of Origin header
	  validation introduces a Cross-Site WebSocket Hijacking
	  (CSWSH) vulnerability.</p>

	  <p>An attacker can host a malicious website that, when
	  visited by a developer running Mailpit locally, establishes
	  a WebSocket connection to the victim's Mailpit instance
	  (default ws://localhost:8025). This allows the attacker
	  to intercept sensitive data such as email contents,
	  headers, and server statistics in real-time.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-22689</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-524m-q5m7-79mm</url>
    </references>
    <dates>
      <discovery>2026-01-10</discovery>
      <entry>2026-01-10</entry>
    </dates>
  </vuln>

  <vuln vid="79c3c751-ee20-11f0-b17e-50ebf6bdf8e9">
    <topic>phpmyfaq -- multiple vulnerabilities</topic>
    <affects>
      <package>
	<name>phpmyfaq-php82</name>
	<name>phpmyfaq-php83</name>
	<name>phpmyfaq-php84</name>
	<name>phpmyfaq-php85</name>
	<range><lt>4.0.16</lt></range>
      </package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpMyFAQ team reports:</p>
	<blockquote cite="https://www.phpmyfaq.de/security/advisory-2025-12-29/">
	  <p>Stored cross-site scripting (XSS) and unauthenticated config backup
	    download vulnerability</p>
	</blockquote>
	</body>
    </description>
    <references>
      <url>https://www.phpmyfaq.de/security/advisory-2025-12-29/</url>
    </references>
    <dates>
      <discovery>2025-12-29</discovery>
      <entry>2026-01-10</entry>
    </dates>
  </vuln>

  <vuln vid="8826fb1c-ebd8-11f0-a15a-a8a1599412c6">
    <topic>chromium -- multiple security fixes</topic>
    <affects>
      <package>
       <name>chromium</name>
       <range><lt>143.0.7499.192</lt></range>
      </package>
      <package>
       <name>ungoogled-chromium</name>
       <range><lt>143.0.7499.192</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
       <p>Chrome Releases reports:</p>
       <blockquote cite="https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html">
	 <p>This update includes 1 security fix:</p>
	 <ul>
	    <li>[463155954] High CVE-2026-0628: Insufficient policy enforcement in WebView tag. Reported by Gal Weizman on 2025-11-23</li>
	 </ul>
       </blockquote>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-0628</cvename>
      <url>https://chromereleases.googleblog.com/2026/01/stable-channel-update-for-desktop.html</url>
    </references>
    <dates>
      <discovery>2026-01-06</discovery>
      <entry>2026-01-07</entry>
    </dates>
  </vuln>

  <vuln vid="583b63f5-ebae-11f0-939f-47e3830276dd">
	  <topic>security/libsodium -- crypto_core_ed25519_is_valid_point mishandles checks for whether an elliptic curve point is valid</topic>
    <affects>
<package>
<name>libsodium</name>
<range><lt>1.0.21</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Libsodium maintainer reports:</p>
	<blockquote cite="https://00f.net/2025/12/30/libsodium-vulnerability/">
	  <p>The function crypto_core_ed25519_is_valid_point(), a low-level function
	  used to check if a given elliptic curve point is valid, was supposed to
	  reject points that aren't in the main cryptographic group,
	  but some points were slipping through.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-69277</cvename>
      <url>https://00f.net/2025/12/30/libsodium-vulnerability/</url>
    </references>
    <dates>
      <discovery>2025-12-30</discovery>
      <entry>2026-01-07</entry>
    </dates>
  </vuln>

  <vuln vid="df33c83b-eb4f-11f0-a46f-0897988a1c07">
    <topic>mail/mailpit -- Server-Side Request Forgery</topic>
    <affects>
<package>
<name>mailpit</name>
<range><lt>1.28.1</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>Mailpit author reports:</p>
	<blockquote cite="https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr">
	  <p>A Server-Side Request Forgery (SSRF) vulnerability
	  exists in Mailpit's /proxy endpoint that allows attackers
	  to make requests to internal network resources.</p>
	  <p>The /proxy endpoint allows requests to internal network
	  resources. While it validates http:// and https:// schemes,
	  it does not block internal IP addresses, allowing attackers
	  to access internal services and APIs.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2026-21859</cvename>
      <url>https://github.com/axllent/mailpit/security/advisories/GHSA-8v65-47jx-7mfr</url>
    </references>
    <dates>
      <discovery>2026-01-06</discovery>
      <entry>2026-01-06</entry>
    </dates>
  </vuln>

  <vuln vid="e2cd20fd-eb10-11f0-a1c0-0050569f0b83">
    <topic>net-mgmt/net-snmp -- Remote Code Execution (snmptrapd)</topic>
    <affects>
<package>
<name>net-snmp</name>
<range><lt>5.9.5</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>net-snmp development team reports:</p>
	<blockquote cite="https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq">
	  <p>A specially crafted packet to an net-snmp snmptrapd daemon can cause a buffer overflow and
	   the daemon to crash.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-68615</cvename>
      <url>https://github.com/net-snmp/net-snmp/security/advisories/GHSA-4389-rwqf-q9gq</url>
    </references>
    <dates>
      <discovery>2025-12-23</discovery>
      <entry>2026-01-06</entry>
    </dates>
  </vuln>

  <vuln vid="500cc49c-e93b-11f0-b8d8-4ccc6adda413">
    <topic>gstreamer1-plugins-bad -- Out-of-bounds reads in MIDI parser</topic>
    <affects>
<package>
<name>gstreamer1-plugins-bad</name>
<range><lt>1.26.10</lt></range>
</package>
    </affects>
    <description>
	<body xmlns="http://www.w3.org/1999/xhtml">
	<p>The GStreamer Security Center reports:</p>
	<blockquote cite="https://gstreamer.freedesktop.org/security/sa-2025-0009.html">
	  <p>Multiple out-of-bounds reads in the MIDI parser that can cause
	  crashes for certain input files.</p>
	</blockquote>
	</body>
    </description>
    <references>
      <cvename>CVE-2025-67326</cvename>
      <cvename>CVE-2025-67327</cvename>
      <url>https://gstreamer.freedesktop.org/security/sa-2025-0009.html</url>
    </references>
    <dates>
      <discovery>2025-12-27</discovery>
      <entry>2026-01-04</entry>
    </dates>
  </vuln>
