oss-sec: by thread

• RSS Feed
• About List
• All Lists

Previous period

Next period

577 messages starting Oct 01 26 and ending Nov 08 26
Date index | Thread index | Author index

• CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening James Netherton (Oct 01)
• CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output Abhishek Choudhary (Oct 01)
• CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation Abhishek Choudhary (Oct 01)
• CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth Abhishek Choudhary (Oct 01)
• CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin Abhishek Choudhary (Oct 01)
• CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory Abhishek Choudhary (Oct 01)
• CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch Abhishek Choudhary (Oct 01)
• CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue Abhishek Choudhary (Oct 01)
• CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol Stig Palmquist (Oct 01)
• CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp Stig Palmquist (Oct 01)
• CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories Eric Covener (Oct 01)
• CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow Eric Covener (Oct 01)
• CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service Eric Covener (Oct 01)
• CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect Eric Covener (Oct 01)
• CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack Eric Covener (Oct 01)
• CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char Eric Covener (Oct 01)
• CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} Eric Covener (Oct 01)
• CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content Eric Covener (Oct 01)
• CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy Eric Covener (Oct 01)
• CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access Eric Covener (Oct 01)
• CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM Eric Covener (Oct 01)
• CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function Eric Covener (Oct 01)
• CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling Eric Covener (Oct 01)
• CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow Eric Covener (Oct 01)
• CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure Eric Covener (Oct 01)
• CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling Eric Covener (Oct 01)
• CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack Eric Covener (Oct 01)
• CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack Eric Covener (Oct 01)
• CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure Eric Covener (Oct 01)
• CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow Eric Covener (Oct 01)
• CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920) Masakazu Kitajo (Oct 02)
• CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Dave Fisher (Oct 02)
  • Re: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Demi Marie Obenour (Oct 07)
• CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode Emmanuel Lécharny (Oct 02)
• CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder Emmanuel Lécharny (Oct 02)
• CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements Emmanuel Lécharny (Oct 02)
• CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS Emmanuel Lécharny (Oct 02)
• CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords Emmanuel Lécharny (Oct 02)
• CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values Emmanuel Lécharny (Oct 02)
• Apache Thrift 0.25.0: 61 CVEs fixed (combined announcement) Jens Geyer (Oct 04)
• cloud computing provider disclosures Jan Schaumann (Oct 04)
  • Re: cloud computing provider disclosures Jonathan Wright (Oct 04)
  • Re: cloud computing provider disclosures Demi Marie Obenour (Oct 04)
    • Re: cloud computing provider disclosures Jan Schaumann (Oct 05)
  • Re: cloud computing provider disclosures Aaron Rainbolt (Oct 04)
    • Re: cloud computing provider disclosures Katie (Oct 04)
    • Re: cloud computing provider disclosures Jeremy Stanley (Oct 05)
• openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder) Security @ Red Eagle Tech (Oct 05)
  • Re: openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder) Security @ Red Eagle Tech (Oct 24)
• [cups] Multiple security fixes in incoming new version 2.4.20 Zdenek Dohnal (Oct 05)
• CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution Stig Palmquist (Oct 05)
• CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes Stig Palmquist (Oct 05)
• CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names Robert Rothenberg (Oct 05)
• CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper Lukasz Lenart (Oct 05)
• CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters Lukasz Lenart (Oct 05)
• CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin Lukasz Lenart (Oct 05)
• CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests Lukasz Lenart (Oct 05)
• libexpat 2.9.0 fixes two vulnerabilities Sebastian Pipping (Oct 05)
• Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released Chad Dougherty (Oct 05)
• CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one Timothy Legge (Oct 05)
• Announce: OpenSSH 10.6 released Damien Miller (Oct 06)
• Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 Sarah Boyce (Oct 06)
• CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1) Ondrej Gajdusek (Oct 06)
• CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser Gary D. Gregory (Oct 06)
• CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS Gary D. Gregory (Oct 06)
• CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records Jan Friedrich (Oct 06)
• CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Jan Friedrich (Oct 06)
• CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter Jan Friedrich (Oct 06)
• CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded Jan Friedrich (Oct 06)
• CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records Jan Friedrich (Oct 06)
• CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content Jan Friedrich (Oct 06)
• CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths Michael Smith (Oct 06)
• CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans Michael Smith (Oct 06)
• CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass Michael Smith (Oct 06)
• FW: X.Org Security Advisory: multiple security issues in X.Org X server Peter Hutterer (Oct 06)
• CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name Wilfred Spiegelenburg (Oct 07)
• CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation Wilfred Spiegelenburg (Oct 07)
• CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery Wilfred Spiegelenburg (Oct 07)
• CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Julian Reschke (Oct 07)
• CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Julian Reschke (Oct 07)
• CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File Jinwoo Hwang (Oct 07)
• [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pending) Goutham Pacha Ravi (Oct 07)
  • Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1 Goutham Pacha Ravi (Oct 07)
• [OSSN-0109] Cross-project metric association bypass in Gnocchi Goutham Pacha Ravi (Oct 07)
• tor-0.4.9.14 released Sam James (Oct 07)
• CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） Wenjun Ruan (Oct 07)
• CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint Wenjun Ruan (Oct 07)
• CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint Wenjun Ruan (Oct 07)
• CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords Wenjun Ruan (Oct 07)
• CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials Wenjun Ruan (Oct 07)
• CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information Wenjun Ruan (Oct 07)
• OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) TheSecguy (Oct 08)
  • Re: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) Stuart Henderson (Oct 09)
• Fwd: Go 1.27.2 and Go 1.26.9 are released Alan Coopersmith (Oct 08)
• Fwd: Vulnerabilities in golang.org/x/net Alan Coopersmith (Oct 08)
  • <Possible follow-ups>
  • Vulnerabilities in golang.org/x/net Alan Coopersmith (Oct 27)
• [OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147)) Jeremy Stanley (Oct 08)
• [OSSN-0110] Ironic can leak basic auth credentials to image server Jay Faulkner (Oct 08)
• Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets Xen . org security team (Oct 09)
• CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Colm O hEigeartaigh (Oct 09)
• CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic Colm O hEigeartaigh (Oct 09)
• CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) Colm O hEigeartaigh (Oct 09)
• CVE-2026-79650: Apache CXF: OIDC RP Open Redirect Colm O hEigeartaigh (Oct 09)
• CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service Colm O hEigeartaigh (Oct 09)
• CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Colm O hEigeartaigh (Oct 09)
• CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests Colm O hEigeartaigh (Oct 09)
• CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security Colm O hEigeartaigh (Oct 09)
• CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. Colm O hEigeartaigh (Oct 09)
• CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Colm O hEigeartaigh (Oct 09)
• CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits Colm O hEigeartaigh (Oct 09)
• CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git Andrea Cosentino (Oct 09)
• CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml Andrea Cosentino (Oct 09)
• Multiple CVEs for illumos and distros: door server processes Dan McDonald (Oct 09)
• CVE for illumos and distros: VMM/BHYVE Dan McDonald (Oct 09)
• Unfixed vulnerabilities in Cyrus SASL Alan Coopersmith (Oct 09)
• mutt 2.4.3 released, fixes CVE-2026-107570 Alan Coopersmith (Oct 09)
• 3 Vulnerabilities in GNU Aspell before 0.60.8.3 Alan Coopersmith (Oct 09)
• CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Lee Rhodes (Oct 10)
• CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes (Oct 10)
• CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes (Oct 10)
• CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch Lee Rhodes (Oct 10)
• CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch Lee Rhodes (Oct 10)
• CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument Robert Rothenberg (Oct 10)
• CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list Robert Rothenberg (Oct 10)
• Incomplete fix for Emacs CVE-2026-79992 Sean Whitton (Oct 11)
  • Re: Incomplete fix for Emacs CVE-2026-79992 Sam James (Oct 14)
    • Re: Incomplete fix for Emacs CVE-2026-79992 Salvatore Bonaccorso (Oct 14)
• Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459) Nebojša Jaćović (Oct 12)
• Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460) Nebojša Jaćović (Oct 12)
• CVE-2026-92116: Apache Allura: OAuth1 missing callback validation Dave Brondsema (Oct 12)
• CVE-2026-92119: Apache Allura: REST API Mass Assignment Dave Brondsema (Oct 12)
• CVE-2026-92120: Apache Allura: Oauth1 Replay Attack Dave Brondsema (Oct 12)
• [vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 Christian Brabandt (Oct 12)
• [vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 Christian Brabandt (Oct 12)
• Fwd: Announcing FreeType version 2.15.0 Alan Coopersmith (Oct 12)
• CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan (Oct 13)
• Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update Xen . org security team (Oct 13)
• Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround Xen . org security team (Oct 13)
• Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems Xen . org security team (Oct 13)
• Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race Xen . org security team (Oct 13)
• Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states Xen . org security team (Oct 13)
• Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush Xen . org security team (Oct 13)
• Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak Xen . org security team (Oct 13)
• Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() Xen . org security team (Oct 13)
• Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 Thomas GERBET (Oct 13)
• rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) Rainer Gerhards (Oct 13)
• Hex 2.5.2 released with security fixes Alan Coopersmith (Oct 13)
• CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape fourie (Oct 13)
• [SECURITY ADVISORIES] curl 8.23.0 Daniel Stenberg (Oct 14)
• Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 Sam James (Oct 14)
• Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup Tomasz Kaye (Oct 14)
  • <Possible follow-ups>
  • Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup Tomasz Kaye (Oct 15)
    • Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup Tomasz Kaye (Oct 23)
• DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries Maxime Coquelin (Oct 14)
• Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader Tomasz Kaye (Oct 14)
  • <Possible follow-ups>
  • Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader Tomasz Kaye (Oct 15)
    • Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader Tomasz Kaye (Oct 23)
• Godot 4.x: heap out-of-bounds write in Radiance HDR image loader Tomasz Kaye (Oct 14)
  • <Possible follow-ups>
  • Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader Tomasz Kaye (Oct 15)
    • Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader Tomasz Kaye (Oct 23)
• Upcoming Node.js security release 2026/10/21 Antoine du Hamel (Oct 14)
  • Re: Upcoming Node.js security release 2026/10/21 Alan Coopersmith (Oct 22)
    • Re: Upcoming Node.js security release 2026/10/21 Jan Schaumann (Oct 23)
      • Re: Upcoming Node.js security release 2026/10/21 Michael Orlitzky (Oct 24)
      • Re: Brotli CVE-2026-111497 Alan Coopersmith (Oct 24)
      • Re: Brotli CVE-2026-111497 Alan Coopersmith (Oct 25)
      • Re: Brotli CVE-2026-111497 Alan Coopersmith (Oct 25)
      • Re: Brotli CVE-2026-111497 Alan Coopersmith (Nov 03)
      • Brotli CVE-2026-111497 and git-remote-https Harry Sintonen (Oct 26)
• Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595) Oleh Konko (Oct 14)
• NSD 4.15.3 security release Willem Toorop (Oct 14)
• linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) Jan Schaumann (Oct 15)
• [vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201 Christian Brabandt (Oct 15)
• FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) eddyflores100 (Oct 15)
  • Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) Solar Designer (Oct 15)
    • Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) eddyflores100 (Oct 16)
      • Re: FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) Alan Coopersmith (Oct 17)
• CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read Jarek Potiuk (Oct 15)
• CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk (Oct 15)
• CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default Jarek Potiuk (Oct 15)
• CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token Jarek Potiuk (Oct 15)
• CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure Li Yang (Oct 15)
• CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump Li Yang (Oct 15)
• CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization Li Yang (Oct 15)
• CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints Li Yang (Oct 15)
• CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass Li Yang (Oct 15)
• CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env Li Yang (Oct 15)
• CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup Li Yang (Oct 15)
• CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard Li Yang (Oct 15)
• CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation Li Yang (Oct 15)
• CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController Li Yang (Oct 15)
• CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) Li Yang (Oct 15)
• CVE-2026-108743: Apache Kylin: spark job OS command injection Li Yang (Oct 15)
• CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass Li Yang (Oct 15)
• CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF Li Yang (Oct 15)
• CVE-2026-108766: Apache Kylin: missing JDBC-config authorization Li Yang (Oct 15)
• CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization Li Yang (Oct 15)
• CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection Li Yang (Oct 15)
• CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue Li Yang (Oct 15)
• CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement Li Yang (Oct 15)
• CVE-2026-108833: Apache Kylin: default startup profile miss security settings Li Yang (Oct 15)
• CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion Li Yang (Oct 15)
• CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication Enxin Xie (Oct 15)
• CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content Enxin Xie (Oct 15)
• CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Enxin Xie (Oct 15)
• CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Enxin Xie (Oct 15)
• CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup Enxin Xie (Oct 15)
• CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Enxin Xie (Oct 15)
• CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Enxin Xie (Oct 15)
• CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Enxin Xie (Oct 15)
• CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Enxin Xie (Oct 15)
• CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Enxin Xie (Oct 15)
• CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Enxin Xie (Oct 15)
• CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Enxin Xie (Oct 15)
• CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content Enxin Xie (Oct 15)
• CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs Bharath SM (Oct 16)
• Infinity Core: Linux Kernel Core LPEs Hyunwoo Kim (Oct 16)
• Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries Alan Coopersmith (Oct 16)
  • Re: Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries Emilio Pozuelo Monfort (Oct 27)
    • Re: Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries Alan Coopersmith (Oct 27)
• Text::CSV_XS versions before 1.65 for Perl (8 CVEs) Stig Palmquist (Oct 16)
• Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Solar Designer (Oct 16)
  • Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Peter Gutmann (Oct 17)
    • Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Rihards Simanovics (Oct 17)
  • <Possible follow-ups>
  • Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Martin Steigerwald (Oct 18)
    • Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Jan Schaumann (Oct 18)
    • Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Peter Gutmann (Oct 18)
      • Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) David A. Wheeler (Oct 18)
• CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata Alexander A. Shvedov (Oct 17)
• CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction Alexander A. Shvedov (Oct 17)
• Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0 Andrea Cosentino (Oct 18)
• CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval Robert Rothenberg (Oct 18)
• Linux KVM/x86: stale SMM MMIO cache bypasses write tracking Jinu Kim (Oct 19)
• CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Andrea Cosentino (Oct 19)
• CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account Jarek Potiuk (Oct 19)
• Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs) Stig Palmquist (Oct 19)
• CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header Robert Rothenberg (Oct 19)
• CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation Adam Reeve (Oct 19)
• eMudhra Intermediates Compromise Dennis Jackson (Oct 20)
  • Re: eMudhra Intermediates Compromise Valtteri Vuorikoski (Oct 20)
    • Re: eMudhra Intermediates Compromise Jeffrey Walton (Oct 20)
    • Re: eMudhra Intermediates Compromise Jeffrey Walton (Oct 20)
      • Re: eMudhra Intermediates Compromise Solar Designer (Oct 20)
      • Re: eMudhra Intermediates Compromise Jakub Wilk (Oct 21)
      • Re: eMudhra Intermediates Compromise Jeffrey Walton (Oct 24)
    • Re: eMudhra Intermediates Compromise Stuart Henderson (Oct 22)
  • Re: eMudhra Intermediates Compromise Alan Coopersmith (Oct 20)
    • Re: eMudhra Intermediates Compromise Solar Designer (Oct 21)
      • Re: eMudhra Intermediates Compromise Hanno Böck (Oct 21)
      • Re: eMudhra Intermediates Compromise Peter Gutmann (Oct 21)
• CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure Arnout Engelen (Oct 20)
• CVE-2026-108087: Apache Cocoon: SQL Injection Arnout Engelen (Oct 20)
• CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning Arnout Engelen (Oct 20)
• CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces Arnout Engelen (Oct 20)
• CVE-2025-52290: FFmpeg NULL pointer dereference in avpriv_h264_has_num_reorder_frames Alexander A. Shvedov (Oct 20)
• CVE-2025-55654: Use-after-free in GPAC/MP4Box gf_filter_pid_get_packet via crafted NHML export input Alexander A. Shvedov (Oct 20)
• CVE-2025-55667: NULL pointer dereference in GPAC/MP4Box dump_isom_saps via crafted MP4 input Alexander A. Shvedov (Oct 20)
• CVE-2025-60480: Heap buffer overflow in GPAC/MP4Box gf_odf_ac4_cfg_alternative_info via crafted AC-4 file Alexander A. Shvedov (Oct 20)
• Roundcube webmail: multiple vulnerabilities prior to 1.6.20 / 1.7.5 Valtteri Vuorikoski (Oct 20)
• CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user Jan Lehnardt (Oct 20)
• CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Jan Lehnardt (Oct 20)
• CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely Jan Lehnardt (Oct 20)
• CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values Jan Lehnardt (Oct 20)
• CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Jan Lehnardt (Oct 20)
• CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs Jan Lehnardt (Oct 20)
• [OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856) Brian Rosmaita (Oct 20)
• [OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195) Goutham Pacha Ravi (Oct 20)
• [oss-security][GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate Alan Coopersmith (Oct 20)
• CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up Mark Thomas (Oct 20)
• CVE-2026-74049: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) Mark Thomas (Oct 20)
• CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Mark Thomas (Oct 20)
• CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination Mark Thomas (Oct 20)
• CVE-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures Mark Thomas (Oct 20)
• CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Mark Thomas (Oct 20)
• CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing Mark Thomas (Oct 20)
• CVE-2026-103119: Apache Tomcat: AJP response mix-up Mark Thomas (Oct 20)
• Go 1.27.3 and Go 1.26.10 are released for CA certificate removal Alan Coopersmith (Oct 20)
• NSS 3.131.1 Release - Important Security Updates Alan Coopersmith (Oct 20)
• Upcoming Critical PHP Security Release Alan Coopersmith (Oct 20)
• CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited connections Yusuf Can TURK (Oct 20)
• CVE-2026-113812: Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates Stig Palmquist (Oct 20)
• CVE-2026-108518: DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element Robert Rothenberg (Oct 20)
• CVE-2026-111879: DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock Robert Rothenberg (Oct 20)
• CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key Robert Rothenberg (Oct 20)
• CVE-2026-112202: Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images Stig Palmquist (Oct 20)
• Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) Hanno Böck (Oct 20)
  • Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) LN Liberda (Oct 21)
  • Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) Hanno Böck (Oct 21)
• Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 Weibing Wang (Oct 20)
• CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption Jakub Zelenka (Oct 21)
  • Re: CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption Christian Fischer (Oct 23)
• CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Jakub Zelenka (Oct 21)
  • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Aaron Rainbolt (Oct 21)
    • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Yves-Alexis Perez (Oct 21)
      • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Emmanuel Fleury (Oct 22)
      • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Emmanuel Fleury (Oct 22)
    • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Aaron Rainbolt (Oct 21)
      • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Nicolas Vigier (Oct 22)
    • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Jakub Zelenka (Oct 22)
  • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Christian Fischer (Oct 21)
    • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Lukas Tribus (Oct 22)
    • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Markus Gschwendt (Oct 22)
    • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Goetz T. Fischer (Oct 22)
  • Re: CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Christian Fischer (Oct 23)
• ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) Andoni Duarte Pintado (Oct 21)
• PowerDNS Security Advisory 2026-13: Crafted packet using compression pointers can lead to denial of service Miod Vallat (Oct 21)
• PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues Otto Moerbeek (Oct 21)
• Unbound: 1.26.2 addresses multiple CVE items Yorgos Thessalonikefs (Oct 21)
• CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes Rich Felker (Oct 21)
• CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver Haonan Hou (Oct 21)
• CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface Haonan Hou (Oct 21)
• CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation Haonan Hou (Oct 21)
• CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Haonan Hou (Oct 21)
• Pillow 13.0.0 fixes long list of vulnerabilities Alan Coopersmith (Oct 21)
• Apache Pulsar: 14 CVEs fixed in 4.0.14, 4.2.5 and 5.0.0 (combined announcement) Lari Hotari (Oct 21)
• Apache Pulsar Manager: CVE-2026-105944, missing authentication and admin credential disclosure; end of life Lari Hotari (Oct 21)
• CVE-2026-113811: Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search Robert Rothenberg (Oct 21)
• CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no Robert Rothenberg (Oct 21)
• CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts Robert Rothenberg (Oct 21)
• CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request Robert Rothenberg (Oct 21)
• Header Accordions: QPACK amplification attacks against HTTP/3 servers Alan Coopersmith (Oct 21)
• one more reason to update libpcap to at least 1.10.7 Denis Ovsienko (Oct 22)
• aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass) [GHSA-wq25-fm54-5q3q, CVE pending] Hannes von Haugwitz (Oct 22)
• aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5, CVE pending] Hannes von Haugwitz (Oct 22)
• [OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458) Jay Faulkner (Oct 22)
• [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419) Jay Faulkner (Oct 22)
• [OSSN-0111] oslo.utils can log LUKS key material Brian Rosmaita (Oct 22)
• CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing Piotr Karwasz (Oct 22)
• Comodo AAA Services Root and S/MIME Hanno Böck (Oct 22)
  • Re: Comodo AAA Services Root and S/MIME Steffen Nurpmeso (Oct 22)
• Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux) 賴奇佑 (Oct 22)
• CVE-2025-60469: NULL pointer dereference in GPAC/MP4Box AC-4 parser via crafted file Alexander A. Shvedov (Oct 22)
• CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup Alexander A. Shvedov (Oct 22)
• CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file Alexander A. Shvedov (Oct 22)
• CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene Alexander A. Shvedov (Oct 22)
• CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file Alexander A. Shvedov (Oct 22)
• CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame rate index Alexander A. Shvedov (Oct 22)
• CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6) Oleksii Molchanov (Oct 22)
  • Re: CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6) Oleksii Molchanov (Oct 23)
• Information for Python users regarding eMudhra / emSign CA certificate security incident Alan Coopersmith (Oct 22)
  • Python 3.15.1, 3.14.9 and 3.13.17 are out Alan Coopersmith (Oct 22)
  • Re: Information for Python users regarding eMudhra / emSign CA certificate security incident Valtteri Vuorikoski (Oct 22)
    • Re: Information for Python users regarding eMudhra / emSign CA certificate security incident Eli Schwartz (Oct 22)
    • Re: Information for Python users regarding eMudhra / emSign CA certificate security incident Sam Bull (Oct 23)
  • Re: Information for Python users regarding eMudhra / emSign CA certificate security incident Stuart Henderson (Oct 23)
  • Re: Information for Python users regarding eMudhra / emSign CA certificate security incident Kevin Riggle (Oct 27)
    • Re: Information for Python users regarding eMudhra / emSign CA certificate security incident Jakub Wilk (Oct 28)
• Plone security fix 20261022: information disclosure Maurits van Rees (Plone) (Oct 22)
• CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory Alan Coopersmith (Oct 22)
• CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion Abhinav Agarwal (Oct 22)
• CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved Andrea Cosentino (Oct 23)
• CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache Andrea Cosentino (Oct 23)
• CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) Andrea Cosentino (Oct 23)
• CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory Andrea Cosentino (Oct 23)
• CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry Andrea Cosentino (Oct 23)
• CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions Andrea Cosentino (Oct 23)
• CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino (Oct 23)
• CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input Alexander A. Shvedov (Oct 23)
• CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input Alexander A. Shvedov (Oct 23)
• CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input Alexander A. Shvedov (Oct 23)
• CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input Alexander A. Shvedov (Oct 23)
• CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input Alexander A. Shvedov (Oct 23)
• CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input Alexander A. Shvedov (Oct 23)
• CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input Alexander A. Shvedov (Oct 23)
• CVE-2026-115721: Apache Vysper: Unbounded allocation Thomas Wolf (Oct 23)
• CVE-2026-115748: Apache Vysper: Authorization bypass Thomas Wolf (Oct 23)
• PHP Informational advisory: Session upload progress (CVE-2026-115560) Alan Coopersmith (Oct 23)
• Ruby Regexp compilation fixes related to GitLab's CVE's Alan Coopersmith (Oct 23)
• nginx RCEs CVE-2026-93479, CVE-2026-15176 Jan Schaumann (Oct 23)
• CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions Robert Rothenberg (Oct 23)
• CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder Timothy Legge (Oct 23)
• jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions Joachim Rütter (Oct 24)
• CVE-2026-114629: Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters Robert Rothenberg (Oct 24)
• [oss-security][CVE-2026-115557] Distrust compromised intermediate certificates in Python ssl module Alan Coopersmith (Oct 24)
• CVE-2026-111813 etc: Multiple vulnerabilities in Apache Traffic Server prior to 9.2.16/10.1.5/10.2.1 Valtteri Vuorikoski (Oct 24)
• PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Roman Kuligin (Oct 24)
  • Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Demi Marie Obenour (Oct 25)
    • Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Michael Orlitzky (Oct 26)
      • Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Peter Wolanin (Oct 26)
      • Re: PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Demi Marie Obenour (Oct 27)
• CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input Alexander A. Shvedov (Oct 24)
• CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata Alexander A. Shvedov (Oct 25)
• CVE-2026-72844: Lean 4 kernel soundness bug — forging proofs via nested inductive projections (0 = 1 demonstrated) Jonathan Brossard (Oct 25)
• CVE-2026-72711: Lean 4 kernel soundness bug — inference cache poisoning via opaque declarations (0 = 1 demonstrated) Jonathan Brossard (Oct 25)
• CVE-2026-72703: Rocq guard checker accepts non-terminating fixpoint via unchecked cross-calls (0 = 1 demonstrated) Jonathan Brossard (Oct 25)
• CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day Jonathan Brossard (Oct 25)
• CVE-2026-72705: Rocq guard checker accepts fixpoint passed as higher-order argument (0 = 1 demonstrated) Jonathan Brossard (Oct 25)
• CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated) — 0-day Jonathan Brossard (Oct 25)
• CVE-2020-37268: Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline (0 = 1 demonstrated) — unfixed since 2020 Jonathan Brossard (Oct 25)
• CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length Robert Rothenberg (Oct 25)
• Starman versions before 0.4019 for Perl (4 CVEs) Robert Rothenberg (Oct 25)
• GNU patch 2.8.1 released, fixes CVE-2026-115207 Alan Coopersmith (Oct 26)
• CVE-2026-112818: git-annex cross-repository data exfiltration Joey Hess (Oct 26)
• CVE-2025-60467: GPAC/MP4Box: Use-After-Free in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file Alexander A. Shvedov (Oct 26)
• Godot 4.x: arbitrary code execution via .po translation file Plural-Forms header Tomasz Kaye (Oct 26)
• CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host Hussein Awala (Oct 26)
• Seccomp denylist bypass via 32-bit syscall argument truncation Ricardo Branco (Oct 27)
• Multiple vulnerabilities in HTSlib <= 1.24 Robert Davies (Oct 27)
• Multiple vulnerabilities in samtools <= 1.24 Robert Davies (Oct 27)
• Godot 4.x: remote client crash via multiplayer spawn packet sync_len overflow Tomasz Kaye (Oct 27)
• Godot 3.x/4.x: remote crash via DTLS receive-callback heap buffer overflow Tomasz Kaye (Oct 27)
• Three TLS Bugs in GoAhead web server prior to 6.1.1 Alan Coopersmith (Oct 27)
• CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream Alexander A. Shvedov (Oct 27)
• CVE-2026-97631: Pre-boot RCE in EDK II PXE driver Valtteri Vuorikoski (Oct 28)
• Multiple vulnerabilities in Jenkins Kevin Guerroudj (Oct 28)
• CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. Manikumar (Oct 28)
• CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default Manikumar (Oct 28)
• CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured Manikumar (Oct 28)
• CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers Manikumar (Oct 28)
• CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service Manikumar (Oct 28)
• CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing Manikumar (Oct 28)
• CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation Manikumar (Oct 28)
• CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation Manikumar (Oct 28)
• CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions Manikumar (Oct 28)
• CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint Manikumar (Oct 28)
• CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs Manikumar (Oct 28)
• CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches Manikumar (Oct 28)
• CVE-2026-102479: Request smuggling in Eclipse Vert.x HTTP/1.x decoder Alan Coopersmith (Oct 28)
• HTTP::Body versions before 1.24_01 for Perl (9 CVEs) Robert Rothenberg (Oct 28)
• MIME-tools versions before 5.521 for Perl (10 CVEs) Robert Rothenberg (Oct 28)
• CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. Andrew Stitcher (Oct 28)
• CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash Andrew Stitcher (Oct 28)
• CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames Andrew Stitcher (Oct 28)
• CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read Andrew Stitcher (Oct 28)
• [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638) Jay Faulkner (Oct 29)
• [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642) Jeremy Stanley (Oct 29)
• CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup Alexander A. Shvedov (Oct 29)
• CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port Alan Coopersmith (Oct 29)
• Fwd: Protecting against CVE-2026-98432 when using Go programs Alan Coopersmith (Oct 29)
  • Re: Protecting against CVE-2026-98432 when using Go programs John Haxby (Oct 30)
• Multiple vulnerabilities in Suricata before 8.0.8 Victor Julien (Oct 29)
• CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt Stig Palmquist (Oct 29)
• CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API Terence Monteiro (Oct 29)
• CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints Terence Monteiro (Oct 29)
• Non-OSS: Claude Code for VS Code extension compromised Valtteri Vuorikoski (Oct 30)
  • Re: Non-OSS: Claude Code for VS Code extension compromised Henri Salo (Oct 30)
• CVE-2025-70102: dhcpcd: NULL Pointer Dereference in Configuration Option Parsing Alexander A. Shvedov (Oct 30)
• CVE-2026-87768: DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds Robert Rothenberg (Oct 30)
• CVE-2026-118988: CallBackery versions before 0.60.1 for Perl let unauthenticated clients read the POD of any file via path traversal in the /doc route Robert Rothenberg (Oct 30)
• CVE-2026-116130: HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_INFO at an encoded NUL byte in parse_http_request Robert Rothenberg (Oct 30)
• Starlet versions before 0.33 for Perl (4 CVEs) Robert Rothenberg (Oct 30)
• Business::GoCardless versions before 1.01 for Perl (3 CVEs) Robert Rothenberg (Oct 30)
• CallBackery versions before 0.62.0 for Perl (10 CVEs) Robert Rothenberg (Oct 30)
• CVE-2026-73322: Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup() Yash Mayya (Oct 30)
• The GNU C Library security advisories update for 2026-10-30 Adhemerval Zanella Netto (Oct 30)
• Re: CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade Abhinav Agarwal (Oct 30)
• Fwd: GNU mtools 4.0.50 released, fixes CVE-2026-118384 Alan Coopersmith (Oct 30)
• CVE-2026-120135: Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default Jens Geyer (Oct 30)
• CVE-2026-118636: Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder Emmanuel Lécharny (Oct 31)
• WebDyne for Perl (5 CVEs) Robert Rothenberg (Oct 31)
• CVE-2026-98432: init_on_free=1 as an additional interim mitigation Rui Sousa (Oct 31)
  • Re: CVE-2026-98432: init_on_free=1 as an additional interim mitigation Sultan Alsawaf (Nov 02)
• CVE-2026-115946: XS::ibbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder Timothy Legge (Oct 31)
• CVE-2026-13575: HTTP::Session versions before 0.54 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::CHI Robert Rothenberg (Nov 01)
• Google::Auth for Perl (2 CVEs) Robert Rothenberg (Nov 01)
• Apache Wicket: 19 CVEs fixed in 8.20.0, 9.25.0 and 10.12.0 Emond Papegaaij (Nov 01)
• Multiple vulnerabilities in C-Kermit John Goerzen (Nov 01)
• CVE-2026-111959: Apache Arrow Rust: Improper validation of RunEndEncoded arrays allows out of bounds reads Jeffrey Vo (Nov 02)
• CVE-2026-119724: Apache JClouds: XML External Entity (XXE) in provider-response parsing Arnout Engelen (Nov 02)
• CVE-2026-119641: Apache Oozie: workflow rerun bypasses the per-job ACL and reassigns ownership Arnout Engelen (Nov 02)
• CVE-2026-65059: Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses Robert Rothenberg (Nov 02)
• libexpat 2.10.0 fixes two vulnerabilities Sebastian Pipping (Nov 02)
• CVE-2026-109083: Apache Syncope: Remote Code Execution via Flowable JUEL expression Francesco Chicchiriccò (Nov 02)
• CVE-2026-110535: Apache Syncope: AuthProfile value escalation via self-service update Francesco Chicchiriccò (Nov 02)
• CVE-2026-113511: Apache Syncope: Delegated administration boundaries can be bypassed for Realm update Francesco Chicchiriccò (Nov 02)
• CVE-2026-113687: Apache Syncope: RCE via ProcessGroovyMethodsSandbox bypass Francesco Chicchiriccò (Nov 02)
• CVE-2026-114364: Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search Francesco Chicchiriccò (Nov 02)
• Re: OATH Toolkit PSKC Signature Verification bypass in libpskc (CVE-2026-109117) Simon Josefsson (Nov 02)
• CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier Robert Rothenberg (Nov 03)
• CVE-2026-114442: Apache HertzBeat: incomplete XPath expression validation in aliasFields Qingran Zhao (Nov 03)
• Apache Traffic Server: heap-buffer-overflow via HTTP Host header (unbounded alloca pattern, 5 sites) — 90-day disclosure feng (Nov 03)
• Xen Security Advisory 523 v2 (CVE-2026-102703,CVE-2026-102704) - arbitrary read/write via grant copy Xen . org security team (Nov 03)
• [SECURITY] Apache Juneau 9.2.1 fixes multiple vulnerabilities (CVE-2026-73095, ..., CVE-2026-73117) James Bognar (Nov 03)
• Django CVE-2026-108147, CVE-2026-111211, CVE-2026-111362, CVE-2026-113593, CVE-2026-113733, and CVE-2026-114582 Jacob Walls (Nov 03)
• CVE-2026-100235: Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation Andor Molnar (Nov 03)
• CVE-2026-100252: Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID Andor Molnar (Nov 03)
• CVE-2026-100300: Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread Andor Molnar (Nov 03)
• CVE-2026-100302: Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling Andor Molnar (Nov 03)
• CVE-2026-115448: Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable Andor Molnar (Nov 03)
• OpenVox Server RCE and client impersonation vulnerabilities Ben Ford (Nov 03)
• CVE-2026-103582: Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS) Christopher L. Shannon (Nov 03)
• CVE-2026-108500: Apache ActiveMQ: LDAPAuthorizationMap allows authorization bypass via DN injection Matt Pavlovich (Nov 03)
• CVE-2026-108946: Apache ActiveMQ, ActiveMQ Broker: The broker does not verify user provided connection id matches connection Christopher L. Shannon (Nov 03)
• CVE-2026-108949: Apache ActiveMQ, ActiveMQ Broker: Repeated rejected temporary destination consumer requests can lead to broker OOM Christopher L. Shannon (Nov 03)
• CVE-2026-111821: Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal Christopher L. Shannon (Nov 03)
• CVE-2026-111822: Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation Christopher L. Shannon (Nov 03)
• CVE-2026-59263: Apache OpenOffice: Carefully crafted documents could display different data when opened with different programs, instead of being reported as corrupt. Arrigo Marchiori (Nov 03)
• CVE-2026-59264: Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer Arrigo Marchiori (Nov 03)
• CVE-2026-59267: Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption Arrigo Marchiori (Nov 03)
• CVE-2026-59268: Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader Arrigo Marchiori (Nov 03)
• CVE-2026-90624: Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability Arrigo Marchiori (Nov 03)
• CVE-2026-90626: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files Arrigo Marchiori (Nov 03)
• CVE-2026-90627: Apache OpenOffice: Local file inclusion via SQL provider and flat file database references Arrigo Marchiori (Nov 03)
• CVE-2026-90628: Apache OpenOffice: Stack overflow in CFF hint handling Arrigo Marchiori (Nov 03)
• CVE-2026-90629: Apache OpenOffice: Out of bounds memory access during WMF import Arrigo Marchiori (Nov 03)
• CVE-2026-90631: Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables Arrigo Marchiori (Nov 03)
• CVE-2026-90632: Apache OpenOffice: Local file inclusion via GStreamer plugin Arrigo Marchiori (Nov 03)
• CVE-2026-90634: Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files Arrigo Marchiori (Nov 03)
• CGI versions before 5.00 for Perl (20 CVEs) Stig Palmquist (Nov 03)
• Rails security releases: 8.0.5.2 and 8.1.4.1 Mike Dalessio (Nov 03)
• Node.js security release pre-alert Antoine du Hamel (Nov 04)
• CVE-2026-121632: Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping Robert Rothenberg (Nov 04)
• CVE-2026-114627: Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output Robert Rothenberg (Nov 04)
• SQL-Abstract versions before 2.000001_04 for Perl (3 CVEs) Robert Rothenberg (Nov 04)
• [SECURITY] Apache Juneau 9.2.1 fixes multiple vulnerabilities (CVE-2026-73095, CVE-2026-121489, CVE-2026-96677, CVE-2026-73099, CVE-2026-73100, CVE-2026-73101, CVE-2026-73098, CVE-2026-73116, CVE-2026-73117) James Bognar (Nov 04)
• libtar: incomplete fix for CVE-2021-33643/CVE-2021-33644 (heap out-of-bounds read) nick (Nov 04)
• Apache OFBiz: CVE Announcements Jacopo Cappellato (Nov 04)
• The GNU C Library security advisories update for 2026-11-04 Carlos O'Donell (Nov 04)
• GodotSteam 4.17 through 4.23.2: any multiplayer peer can claim the server's peer ID Tomasz Kaye (Nov 04)
  • Re: GodotSteam 4.17 through 4.23.2: any multiplayer peer can claim the server's peer ID Tomasz Kaye (Nov 05)
• CVE-2026-109518: RCE in apt(1) (DSA 6607-1) Jan Schaumann (Nov 04)
• Fwd: 3 unixODBC<=2.3.14 issues from fulldisclosure mailing list Alan Coopersmith (Nov 05)
• Announce: Portable OpenSSH 10.6p2 released Damien Miller (Nov 05)
• "sshole": password authentication bypass: OpenSSH + musl libc Jan Schaumann (Nov 05)
  • Re: "sshole": password authentication bypass: OpenSSH + musl libc Loganaden Velvindron (Nov 05)
    • Re: "sshole": password authentication bypass: OpenSSH + musl libc Vincent Lefevre (Nov 05)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc lists (Nov 05)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Vincent Lefevre (Nov 05)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Michael Orlitzky (Nov 05)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Matt Johnston (Nov 05)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Vincent Lefevre (Nov 06)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Martin Steigerwald (Nov 06)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Steffen Nurpmeso (Nov 06)
    • Re: "sshole": password authentication bypass: OpenSSH + musl libc Loganaden Velvindron (Nov 06)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Michael Orlitzky (Nov 06)
      • Message not available
      • Message not available
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc theknell (Nov 06)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Richard Kettlewell (Nov 07)
  • Re: "sshole": password authentication bypass: OpenSSH + musl libc Jeffrey Walton (Nov 05)
    • Re: "sshole": password authentication bypass: OpenSSH + musl libc Peter Gutmann (Nov 06)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Matt Johnston (Nov 06)
      • Message not available
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc theknell (Nov 07)
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc Jacob Bachmeyer (Nov 06)
      • Message not available
      • Re: "sshole": password authentication bypass: OpenSSH + musl libc theknell (Nov 06)
• [kubernetes] CVE-2026-116472: ingress-nginx mirror-target self-DOS Tabitha Sable (Nov 05)
• CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths Joerg Hoh (Nov 05)
• CVE-2026-103864: Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization Joerg Hoh (Nov 05)
• CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling Joerg Hoh (Nov 05)
• zlib 1.4 released with security fixes Alan Coopersmith (Nov 05)
• CPython sandbox escape Alan Coopersmith (Nov 05)
  • Re: CPython sandbox escape Sam James (Nov 05)
• Fwd: Go 1.27.4 and Go 1.26.11 pre-announcement Alan Coopersmith (Nov 05)
• Open WebUI: the Windows installer mints the master key from the install second — CVE-2025-15603 was rejected; here is the measurement theknell (Nov 05)
• CVE-2026-121006: HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time Robert Rothenberg (Nov 06)
• Xen Security Advisory 526 v1 (CVE-2026-100080) - Linux xen-netback: guest can trigger use-after-free for Xen . org security team (Nov 06)
• Xen Security Advisory 527 v1 (CVE-2026-100081) - Linux xen-netback: guest can trigger use-after-free for reading multicast data Xen . org security team (Nov 06)
• Xen Security Advisory 528 v1 (CVE-2026-100082) - Linux xen-blkback: guest can trigger use-after-free for reading statistic data Xen . org security team (Nov 06)
• CVE-2026-90436: Apache Axis 1.x (EOL): unauthenticated remote class instantiation via SOAP fault exceptionName Robert Lazarski (Nov 06)
• CVE-2025-66621: Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred Benoit Tellier (Nov 06)
• CVE-2026-49939: Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol Benoit Tellier (Nov 06)
• CVE-2026-74756: Apache James: WebAdmin exposed without authentication on official Docker default Benoit Tellier (Nov 06)
• CVE-2026-76168: Apache James: ManageSieve file implementation cross-user path traversal Benoit Tellier (Nov 06)
• CVE-2026-76171: Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client Benoit Tellier (Nov 06)
• CVE-2026-85108: Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling Benoit Tellier (Nov 06)
• CVE-2026-85111: Apache James: Denial of service upon MIME parsing Benoit Tellier (Nov 06)
• CVE-2026-120761: Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents Robert Lazarski (Nov 06)
• CVE-2026-123753: Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints Robert Lazarski (Nov 06)
• CVE-2026-123766: Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page Robert Lazarski (Nov 06)
• CVE-2026-123770: Apache Axis2/Java: Unbounded multipart and form-encoded request bodies Robert Lazarski (Nov 06)
• CVE-2026-120367: Apache Axis2/Java: unbounded JSON request body buffering Robert Lazarski (Nov 06)
• CVE-2026-120832: Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution Robert Lazarski (Nov 06)
• CVE-2026-123779: Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes Robert Lazarski (Nov 06)
• InfiniteWP Client: the NOSSL signing key has 31 bits of secret — recovered live in 291.9 seconds theknell (Nov 06)
• [oss-security][CVE-2026-119170] Regression in FIPS enforcement of hash algorithms affecting only Python 3.14.10 Alan Coopersmith (Nov 06)
• CVE-2026-118196: Apache Allura: OAuth1 rebinding Dave Brondsema (Nov 06)
• CVE-2026-121265: SQL::Abstract versions before 2.000003 for Perl allow SQL injection via an arrayref column value in insert and update Robert Rothenberg (Nov 07)
• CVE-2026-123776: RRD::CGI::Image versions through 0.01 for Perl pass CGI query parameters containting "tz" to tzset(), , so a FIFO or device path blocks the CGI process Robert Rothenberg (Nov 07)
• UnrealIRCd 6.2.7.1 released & hot-patch (CVE-2026-114713) Bram Matthys (Nov 08)

Previous period

Next period