oss-security  

Messages by Thread

• [oss-security] CVE-2026-65874: Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints Terence Monteiro
• [oss-security] CVE-2026-64618: Apache Fineract: SQL injection vulnerability in Search API Terence Monteiro
• [oss-security] CVE-2026-115943: Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt Stig Palmquist
• [oss-security] Fwd: Protecting against CVE-2026-98432 when using Go programs Alan Coopersmith
• [oss-security] Multiple vulnerabilities in Suricata before 8.0.8 Victor Julien
• [oss-security] CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port Alan Coopersmith
• [oss-security] [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642) Jeremy Stanley
• [oss-security] [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638) Jay Faulkner
• [oss-security] CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup Alexander A. Shvedov
• [oss-security] CVE-2026-97631: Pre-boot RCE in EDK II PXE driver Valtteri Vuorikoski
• [oss-security] CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read Andrew Stitcher
• [oss-security] CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames Andrew Stitcher
• [oss-security] CVE-2026-105042: Apache Qpid Proton C: Unbounded recursion in parsing AMQP message bodies can lead to crash Andrew Stitcher
• [oss-security] CVE-2026-112375: Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs Manikumar
• [oss-security] CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors. Andrew Stitcher
• [oss-security] MIME-tools versions before 5.521 for Perl (10 CVEs) Robert Rothenberg
• [oss-security] HTTP::Body versions before 1.24_01 for Perl (9 CVEs) Robert Rothenberg
• [oss-security] CVE-2026-102479: Request smuggling in Eclipse Vert.x HTTP/1.x decoder Alan Coopersmith
• [oss-security] CVE-2026-111496: Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation Manikumar
• [oss-security] CVE-2026-115644: Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions Manikumar
• [oss-security] CVE-2026-114349: Apache Kafka: Denial of service via unbounded memory allocation when decoding compressed record batches Manikumar
• [oss-security] CVE-2026-116593: Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint Manikumar
• [oss-security] CVE-2026-110985: Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured Manikumar
• [oss-security] CVE-2026-111551: Apache Kafka: Denial of service in Kafka Streams and client deserializers via unbounded memory allocation Manikumar
• [oss-security] CVE-2026-111073: Apache Kafka: PushTelemetry (KIP-714) metrics payloads are decompressed without a size limit, allowing a broker out-of-memory denial of service Manikumar
• [oss-security] CVE-2026-111115: Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing Manikumar
• [oss-security] CVE-2026-111108: Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers Manikumar
• [oss-security] CVE-2026-110952: Apache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default Manikumar
• [oss-security] CVE-2026-83525: Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request. Manikumar
• [oss-security] CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow Read in gf_ac4_parser_bs on crafted AC-4 stream Alexander A. Shvedov
• [oss-security] Three TLS Bugs in GoAhead web server prior to 6.1.1 Alan Coopersmith
• [oss-security] Vulnerabilities in golang.org/x/net Alan Coopersmith
• [oss-security] Multiple vulnerabilities in samtools <= 1.24 Robert Davies
• [oss-security] Godot 3.x/4.x: remote crash via DTLS receive-callback heap buffer overflow Tomasz Kaye
• [oss-security] Godot 4.x: remote client crash via multiplayer spawn packet sync_len overflow Tomasz Kaye
• [oss-security] Multiple vulnerabilities in HTSlib <= 1.24 Robert Davies
• [oss-security] Seccomp denylist bypass via 32-bit syscall argument truncation Ricardo Branco
• [oss-security] CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host Hussein Awala
• [oss-security] Godot 4.x: arbitrary code execution via .po translation file Plural-Forms header Tomasz Kaye
• [oss-security] CVE-2025-60467: GPAC/MP4Box: Use-After-Free in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file Alexander A. Shvedov
• [oss-security] CVE-2026-112818: git-annex cross-repository data exfiltration Joey Hess
• [oss-security] GNU patch 2.8.1 released, fixes CVE-2026-115207 Alan Coopersmith
• [oss-security] CVE-2026-72844: Lean 4 kernel soundness bug — forging proofs via nested inductive projections (0 = 1 demonstrated) Jonathan Brossard
• [oss-security] Starman versions before 0.4019 for Perl (4 CVEs) Robert Rothenberg
• [oss-security] CVE-2026-115825: HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length Robert Rothenberg
• [oss-security] CVE-2020-37268: Rocq/Coq Print Assumptions omits unsafe universe checking inlined through Parameter Inline (0 = 1 demonstrated) — unfixed since 2020 Jonathan Brossard
• [oss-security] CVE-2026-72714: Rocq universe checking state desynchronised after module close (0 = 1 demonstrated) — 0-day Jonathan Brossard
• [oss-security] CVE-2026-72705: Rocq guard checker accepts fixpoint passed as higher-order argument (0 = 1 demonstrated) Jonathan Brossard
• [oss-security] CVE-2026-72704: Rocq guard checker trusts corrupted recursive tree after transport (0 = 1 demonstrated) — 0-day Jonathan Brossard
• [oss-security] CVE-2026-72703: Rocq guard checker accepts non-terminating fixpoint via unchecked cross-calls (0 = 1 demonstrated) Jonathan Brossard
• [oss-security] CVE-2026-72711: Lean 4 kernel soundness bug — inference cache poisoning via opaque declarations (0 = 1 demonstrated) Jonathan Brossard
• [oss-security] CVE-2025-60477: GPAC/MP4Box: NULL Pointer Dereference in gf_filter_pid_resolve_file_template_ex on crafted MP4 with special metadata Alexander A. Shvedov
• [oss-security] PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Roman Kuligin
  • Re: [oss-security] PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Demi Marie Obenour
  • Re: [oss-security] PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Michael Orlitzky
  • Re: [oss-security] PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Peter Wolanin
  • Re: [oss-security] PHP 5.4.23 (custom 5.4-5.6) backported patch for PHP2Shell OOM vulnerability (CVE-2026-109618) Demi Marie Obenour
• [oss-security] CVE-2025-60493: GPAC/MP4Box: NULL Pointer Dereference in check_media_profile via Crafted MP4 Input Alexander A. Shvedov
• [oss-security] CVE-2026-111813 etc: Multiple vulnerabilities in Apache Traffic Server prior to 9.2.16/10.1.5/10.2.1 Valtteri Vuorikoski
• [oss-security][CVE-2026-115557] Distrust compromised intermediate certificates in Python ssl module Alan Coopersmith
• [oss-security] CVE-2026-114629: Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters Robert Rothenberg
• [oss-security] jxrlib: memory bugs on damaged JPEG XR files, fixed in mircomir/jxrlib 1.4.4, still in most distributions Joachim Rütter
• [oss-security] nginx RCEs CVE-2026-93479, CVE-2026-15176 Jan Schaumann
• [oss-security] CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 for Perl bundle a brotli library with an out-of-bounds write in the decoder Timothy Legge
• [oss-security] CVE-2026-113877: HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions Robert Rothenberg
• [oss-security] Ruby Regexp compilation fixes related to GitLab's CVE's Alan Coopersmith
• [oss-security] CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions Andrea Cosentino
• [oss-security] CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) Andrea Cosentino
• [oss-security] PHP Informational advisory: Session upload progress (CVE-2026-115560) Alan Coopersmith
• [oss-security] CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory Andrea Cosentino
• [oss-security] CVE-2026-115748: Apache Vysper: Authorization bypass Thomas Wolf
• [oss-security] CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input Alexander A. Shvedov
• [oss-security] CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry Andrea Cosentino
• [oss-security] CVE-2026-90885: Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was Resolved Andrea Cosentino
• [oss-security] CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input Alexander A. Shvedov
• [oss-security] CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input Alexander A. Shvedov
• [oss-security] CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input Alexander A. Shvedov
• [oss-security] CVE-2026-115721: Apache Vysper: Unbounded allocation Thomas Wolf
• [oss-security] CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input Alexander A. Shvedov
• [oss-security] CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input Alexander A. Shvedov
• [oss-security] CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions Andrea Cosentino
• [oss-security] CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input Alexander A. Shvedov
• [oss-security] CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache Andrea Cosentino
• [oss-security] CVE-2026-113873, CVE-2026-113874, CVE-2026-113875, CVE-2026-113876: HAPI FHIR cross-tenant partition override, authorization bypasses and gzip heap exhaustion Abhinav Agarwal
• [oss-security] CPython: [CVE-2026-114583] tarfile.tar_filter path traversal bypass allows writing outside the extraction directory Alan Coopersmith
• [oss-security] Plone security fix 20261022: information disclosure Maurits van Rees (Plone)
• [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Alan Coopersmith
  • [oss-security] Python 3.15.1, 3.14.9 and 3.13.17 are out Alan Coopersmith
  • Re: [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Valtteri Vuorikoski
  • Re: [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Eli Schwartz
  • Re: [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Sam Bull
  • Re: [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Stuart Henderson
  • Re: [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Kevin Riggle
  • Re: [oss-security] Information for Python users regarding eMudhra / emSign CA certificate security incident Jakub Wilk
• [oss-security] CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6) Oleksii Molchanov
  • [oss-security] Re: CVE-2026-109618 / CVE-2026-109619: unofficial backport of the PHP OOM bailout / stale state fix to PHP 5.4.16 (EL7) and 5.3.3 (EL6) Oleksii Molchanov
• [oss-security] CVE-2025-60496: Divide by zero in GPAC/MP4Box reframer via crafted truncated MP4 file Alexander A. Shvedov
• [oss-security] CVE-2025-71438: Out-of-bounds Read in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream with invalid frame rate index Alexander A. Shvedov
• [oss-security] CVE-2025-60479: NULL pointer dereference in GPAC/MP4Box StatSFVec2f via crafted BIFS scene Alexander A. Shvedov
• [oss-security] CVE-2025-60478: Heap use-after-free in GPAC/MP4Box packet destruction via crafted MPEG-2 TS file Alexander A. Shvedov
• [oss-security] CVE-2025-60476: Heap use-after-free in GPAC/MP4Box AC-4 descriptor cleanup Alexander A. Shvedov
• [oss-security] CVE-2025-60469: NULL pointer dereference in GPAC/MP4Box AC-4 parser via crafted file Alexander A. Shvedov
• [oss-security] Unofficial backports for CVE-2026-109618 / CVE-2026-109619 to EOL PHP 7.3 (EL7) and 5.4/5.3 (Amazon Linux) 賴奇佑
• [oss-security] Comodo AAA Services Root and S/MIME Hanno Böck
  • Re: [oss-security] Comodo AAA Services Root and S/MIME Steffen Nurpmeso
• [oss-security] CVE-2026-113582: Apache Abdera: XML external entity expansion in Atom document parsing Piotr Karwasz
• [oss-security] [OSSN-0111] oslo.utils can log LUKS key material Brian Rosmaita
• [oss-security] [OSSA-2026-048] Ironic: Allows generic node update for maintenance setting (CVE-2026-89419) Jay Faulkner
• [oss-security] [OSSA-2026-047] Ironic: Redfish vendor_passthru method allows path injection via ID (CVE-2026-90458) Jay Faulkner
• [oss-security] aide (<= 0.19.4) improper comparison of hash values containing a null byte (AIDE detection bypass) [GHSA-6wc9-4w69-5jc5, CVE pending] Hannes von Haugwitz
• [oss-security] aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass) [GHSA-wq25-fm54-5q3q, CVE pending] Hannes von Haugwitz
• [oss-security] one more reason to update libpcap to at least 1.10.7 Denis Ovsienko
• [oss-security] Header Accordions: QPACK amplification attacks against HTTP/3 servers Alan Coopersmith
• [oss-security] Apache Pulsar: 14 CVEs fixed in 4.0.14, 4.2.5 and 5.0.0 (combined announcement) Lari Hotari
• [oss-security] Apache Pulsar Manager: CVE-2026-105944, missing authentication and admin credential disclosure; end of life Lari Hotari
• [oss-security] CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request Robert Rothenberg
• [oss-security] CVE-2026-94423: Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_hosts Robert Rothenberg
• [oss-security] CVE-2026-94140: Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync transfers because sync hardcodes StrictHostKeyChecking=no Robert Rothenberg
• [oss-security] CVE-2026-113811: Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure shift cache in search Robert Rothenberg
• [oss-security] Pillow 13.0.0 fixes long list of vulnerabilities Alan Coopersmith
• [oss-security] CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption Jakub Zelenka
  • Re: [oss-security] CVE-2026-109618: PHP 8.2–8.5 RCE via OOM corruption Christian Fischer
• [oss-security] CVE-2026-59229: Apache IoTDB: Legacy Pipe Privilege Escalation Haonan Hou
• [oss-security] CVE-2026-59562: Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Haonan Hou
• [oss-security] CVE-2026-107891: musl libc: multiple integer overflow in regcomp, possibly leading to incorrect allocation sizes and out-of-bounds heap writes Rich Felker
• [oss-security] CVE-2026-41114: Apache IoTDB JDBC driver: Large-scale Memory Exhaustion via BigDecimal toPlainString in JDBC Driver Haonan Hou
• [oss-security] CVE-2026-58663: Apache IoTDB: Auth Bypass in pipeTransfer() interface Haonan Hou
• [oss-security] Unbound: 1.26.2 addresses multiple CVE items Yorgos Thessalonikefs
• [oss-security] PowerDNS Security Advisory 2026-12 for PowerDNS Recursor: Multiple issues Otto Moerbeek
• [oss-security] PowerDNS Security Advisory 2026-13: Crafted packet using compression pointers can lead to denial of service Miod Vallat
• [oss-security] ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313) Andoni Duarte Pintado
• [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Jakub Zelenka
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Aaron Rainbolt
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Yves-Alexis Perez
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Aaron Rainbolt
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Christian Fischer
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Lukas Tribus
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Markus Gschwendt
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Goetz T. Fischer
  • Re: [oss-security] CVE-2026-109619: PHP 8.2–8.5 RCE via stale global state Christian Fischer
• [oss-security] Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) Hanno Böck
  • Re: [oss-security] Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) LN Liberda
  • [oss-security] Re: Bundled cert stores + eMudhra cert issue (nmap/ncat, texlive-infra) Hanno Böck
• [oss-security] Apache bRPC security advisory: 35 vulnerabilities fixed in 1.18.0 Weibing Wang
• [oss-security] CVE-2026-112202: Imager::File::GIF versions before 1.006 for Perl allow out-of-bounds reads when consolidating GIF images Stig Palmquist
• [oss-security] CVE-2026-85783: Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key Robert Rothenberg
• [oss-security] CVE-2026-111879: DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lock Robert Rothenberg
• [oss-security] CVE-2026-108518: DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element Robert Rothenberg
• [oss-security] CVE-2026-113812: Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates Stig Palmquist
• [oss-security] CVE-2026-28403, CVE-2026-28412: Textream (macOS) < 1.5.1 local WebSocket server: missing Origin check and unlimited connections Yusuf Can TURK
• [oss-security] Upcoming Critical PHP Security Release Alan Coopersmith
• [oss-security] CVE-2026-101356: Apache Tomcat: HTTP/2 request/response mix-up after error during async processing Mark Thomas
• [oss-security] NSS 3.131.1 Release - Important Security Updates Alan Coopersmith
• [oss-security] Go 1.27.3 and Go 1.26.10 are released for CA certificate removal Alan Coopersmith
• [oss-security] CVE-2025-55654: Use-after-free in GPAC/MP4Box gf_filter_pid_get_packet via crafted NHML export input Alexander A. Shvedov
• [oss-security] CVE-2026-103119: Apache Tomcat: AJP response mix-up Mark Thomas
• [oss-security] CVE-2026-101296: Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms Mark Thomas
• [oss-security] CVE-2026-93446: Apache Tomcat: Possible TLS 1.3 connection failures Mark Thomas
• [oss-security] CVE-2026-88041: Apache Tomcat: HTTP/2 trailer header cross-contamination Mark Thomas
• [oss-security] CVE-2026-80353: Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain Sockets - Fix for CVE-2026-65183 did not address APR connector Mark Thomas
• [oss-security] CVE-2026-74049: Apache Tomcat: Jasper JSTL plug-in implementation omits page abort (SKIP_PAGE) Mark Thomas
• [oss-security] CVE-2026-74048: Apache Tomcat: OpenSSL-FFM FIPS failure does not prevent start-up Mark Thomas
• [oss-security] CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases Jan Lehnardt
• [oss-security][GHSA-6q48-6c7w-9gw2] CRITICAL security update for certifi, removal of emSign root certificate Alan Coopersmith
• [oss-security] [OSSA-2026-046] OpenStack Manila: Manila allows cross-project public-share and export-metadata changes (CVE-2026-71195) Goutham Pacha Ravi
• [oss-security] [OSSA-2026-045] Cinder: Cross-project information disclosure in Cinder Messages API (CVE-2026-93856) Brian Rosmaita
• [oss-security] CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs Jan Lehnardt
• [oss-security] CVE-2026-90799: Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values Jan Lehnardt
• [oss-security] CVE-2026-90798: Apache CouchDB: Replicator follows redirects indefinitely Jan Lehnardt
• [oss-security] CVE-2026-90797: Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session Jan Lehnardt
• [oss-security] CVE-2026-86471: Apache CouchDB: Admin credentials leading to code execution as operating system user Jan Lehnardt
• [oss-security] Roundcube webmail: multiple vulnerabilities prior to 1.6.20 / 1.7.5 Valtteri Vuorikoski
• [oss-security] CVE-2025-60480: Heap buffer overflow in GPAC/MP4Box gf_odf_ac4_cfg_alternative_info via crafted AC-4 file Alexander A. Shvedov
• [oss-security] CVE-2025-55667: NULL pointer dereference in GPAC/MP4Box dump_isom_saps via crafted MP4 input Alexander A. Shvedov
• [oss-security] CVE-2026-108088: Apache Cocoon: Cross-user cache poisoning Arnout Engelen
• [oss-security] CVE-2025-52290: FFmpeg NULL pointer dereference in avpriv_h264_has_num_reorder_frames Alexander A. Shvedov
• [oss-security] CVE-2026-108089: Apache Cocoon: Unauthenticated access to diagnostic interfaces Arnout Engelen
• [oss-security] CVE-2026-108087: Apache Cocoon: SQL Injection Arnout Engelen
• [oss-security] CVE-2026-108086: Apache Cocoon: XEE could lead to SSRF and information disclosure Arnout Engelen
• [oss-security] eMudhra Intermediates Compromise Dennis Jackson
  • Re: [oss-security] eMudhra Intermediates Compromise Valtteri Vuorikoski
  • Re: [oss-security] eMudhra Intermediates Compromise Jeffrey Walton
  • Re: [oss-security] eMudhra Intermediates Compromise Jeffrey Walton
  • Re: [oss-security] eMudhra Intermediates Compromise Solar Designer
  • Re: [oss-security] eMudhra Intermediates Compromise Jakub Wilk
  • Re: [oss-security] eMudhra Intermediates Compromise Jeffrey Walton
  • Re: [oss-security] eMudhra Intermediates Compromise Stuart Henderson
  • Re: [oss-security] eMudhra Intermediates Compromise Alan Coopersmith
  • Re: [oss-security] eMudhra Intermediates Compromise Solar Designer
  • Re: [oss-security] eMudhra Intermediates Compromise Peter Gutmann
  • Re: [oss-security] eMudhra Intermediates Compromise Hanno Böck
• [oss-security] CVE-2026-92287: Apache Arrow C++, PyArrow: Parquet file-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation Adam Reeve
• [oss-security] CVE-2026-111946: Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header Robert Rothenberg
• [oss-security] Cpanel::JSON::XS versions before 4.80 for Perl (15 CVEs) Stig Palmquist
• [oss-security] CVE-2026-86467: Apache Airflow Amazon provider: AWS auth manager: SAML login CSRF logs users into the attacker's account Jarek Potiuk
• [oss-security] CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Andrea Cosentino
• [oss-security] Linux KVM/x86: stale SMM MMIO cache bypasses write tracking Jinu Kim
• [oss-security] CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval Robert Rothenberg
• [oss-security] Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0 Andrea Cosentino
• [oss-security] CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction Alexander A. Shvedov

• Earlier messages