oss-security  

Messages by Date

• 2026/07/28 [oss-security] CVE-2026-50622: Apache Atlas: Missing Authorization on Admin Endpoints Radhika Kundam
• 2026/07/28 [oss-security] [OSSA-2026-031] OpenStack Swift: Proxy denial of service via Accept header (CVE-2026-pending) Goutham Pacha Ravi
• 2026/07/28 [oss-security] [OSSA-2026-030] OpenStack Swift: S3API header authorization bypass (CVE-2026-pending) Goutham Pacha Ravi
• 2026/07/28 [oss-security] CVE-2026-66299: Apache Tomcat: DoS via WebSocket chat example Mark Thomas
• 2026/07/28 [oss-security] Xen Security Advisory 508 v2 - pygrub is only supported in de-privileged mode Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 507 v2 (CVE-2026-62434) - PoD: Don't try to reclaim special pages Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 506 v2 (CVE-2026-62433) - correct buffer checks for DM_OP hypercalls Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 505 v2 (CVE-2026-62432) - evtchn: Race between FIFO expand and reset Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 504 v2 (CVE-2026-62431) - Viridian STIMER division by zero Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 503 v2 (CVE-2026-62430) - x86: Out-of-bounds read in vRTC emulation Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 502 v3 (CVE-2026-62429) - vNUMA domain cleanup may race other operations Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 501 v4 (CVE-2026-62435,CVE-2026-62436) - grant-table: version change racing with other operations Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 500 v2 (CVE-2026-62428) - grant-table: type confusion in grant-copy Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 497 v2 (CVE-2026-42494,CVE-2026-42495,CVE-2026-62423,CVE-2026-62424,CVE-2026-62425) - buffer overruns in libfsimage iso9660 handling Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 496 v2 (CVE-2026-42492) - vIRQ event channel binding may break Xenstore Xen . org security team
• 2026/07/28 [oss-security] Xen Security Advisory 495 v2 (CVE-2026-42493) - x86 shadow paging is deprecated Xen . org security team
• 2026/07/28 [oss-security] [CVE pending] Eclipse Milo <= 1.1.4: password-recovery oracle, pre-auth DoS, and four server flaws Abhinav Agarwal
• 2026/07/28 [oss-security] CVE-2026-59243: Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`) Shahar Epstein
• 2026/07/28 Re: [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Sam James
• 2026/07/28 [oss-security] OVSwrap (CVE-2026-64531): Linux kernel/OVS local root vulnerability manizada
• 2026/07/28 [oss-security] [NotCVE-2026-0009] NitroShare Desktop 0.3.4 Path Traversal Allows LAN-Adjacent Arbitrary File Write advisories
• 2026/07/28 Re: [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Greg KH
• 2026/07/28 Re: [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Reid Sutherland
• 2026/07/27 [oss-security] [NotCVE-2026-0010] Barrier 2.4.0 for Windows Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM advisories
• 2026/07/27 [oss-security] CVE-2026-17552: Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call Robert Rothenberg
• 2026/07/27 [oss-security] CVE-2026-66713: Apache Axis2/Java: deserialization of untrusted Data Robert Lazarski
• 2026/07/27 Re: [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Sam James
• 2026/07/27 [oss-security] CVE-2026-61487: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations Christopher L. Shannon
• 2026/07/27 [oss-security] CVE-2026-59878: Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS Christopher L. Shannon
• 2026/07/27 Re: [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Reid Sutherland
• 2026/07/27 [oss-security] CVE-2026-66391: Apache Wicket: leaked and missing CSP headers Pedro Henrique Oliveira dos Santos
• 2026/07/27 [oss-security] CVE-2026-66390: Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence Pedro Henrique Oliveira dos Santos
• 2026/07/27 Re: [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Solar Designer
• 2026/07/27 [oss-security] Linux kernel: KVM: Merge branch 'kvm-chainsaw' into HEAD Reid Sutherland
• 2026/07/27 Re: [oss-security] 432 Linux kernel CVEs Loganaden Velvindron
• 2026/07/26 [oss-security] [security] critical vulnerabilities patched in svxlink (RCE) Mark Rose
• 2026/07/25 Re: [oss-security] 432 Linux kernel CVEs Demi Marie Obenour
• 2026/07/25 [oss-security] CVE-2026-16766: Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options Robert Rothenberg
• 2026/07/25 [oss-security] GNU Inetutils talkd buffer overflow with long DNS names. Collin Funk
• 2026/07/25 [oss-security] CVE-2026-53910: GNU diffutils bug, and some thoughts on "security" reports Collin Funk
• 2026/07/25 [oss-security] Fwd: The GNU C Library version 2.44 is now available, fixes 3 CVEs Alan Coopersmith
• 2026/07/24 [oss-security] CVE-2026-66053: Apache Thrift: Python TSSLSocket Hostname Matcher Import Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-58662: Apache Thrift: C++ THeaderTransport::readString() info-header length bounds bypass Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-58389: Apache Thrift: Rust binary protocol non-strict path missing string size limit Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-55971: Apache Thrift: C++ ZLIB heap buffer overflow (write) in THeaderTransport::untransform() Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-58023: Apache Thrift: c_glib heap out-of-bounds read in transport leftover-bytes path Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-55970: Apache Thrift: C++ heap out-of-bounds read in THeaderTransport::readHeaderFormat() Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-55969: Apache Thrift: integer overflow in TProtocol::checkReadBytesAvailable() Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-55968: Apache Thrift: Node.js quadratic-time DoS in server receive transports Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-49158: Apache Thrift: Ruby THeaderTransport ZLIB Decompression Bomb Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-48586: Apache Thrift: TZlibTransport Decompression Size Limit Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-48145: Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-48144: Apache Thrift: c_glib TLS Client Missing Hostname Verification Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-45112: Apache Thrift: Unbounded Read Leading to Denial of Service Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-43871: Apache Thrift: TCompactProtocol varint byte-count limit Jens Geyer
• 2026/07/24 [oss-security] CVE-2026-41608: Apache Thrift: Unbounded Zlib Decompression in Python THeaderTransport Jens Geyer
• 2026/07/24 [oss-security] [vim-security] Arbitrary Command Execution via the Vimball Record File in Vim < 9.2.0847 Christian Brabandt
• 2026/07/24 [oss-security] [vim-security] Heap Buffer Overflow when Loading a Spell File in Vim < 9.2.0846 Christian Brabandt
• 2026/07/24 [oss-security] [vim-security] Arbitrary Ex Command Execution in C Omni-Completion in Vim < 9.2.0845 Christian Brabandt
• 2026/07/24 [oss-security] [vim-security] Use-after-free in JSON Decoding in Vim >= 9.2.0511 && Vim < 9.2.0844 Christian Brabandt
• 2026/07/24 [oss-security] Re: [OSSA-2026-029] OpenStack Zaqar: EXTRA-SPEC header bypasses Keystone authentication (CVE-2026-66139) Goutham Pacha Ravi
• 2026/07/24 [oss-security] Re: [OSSA-2026-027] OpenStack Ironic Python Agent: Command execution via unsanitized config (CVE-2026-66138) Goutham Pacha Ravi
• 2026/07/24 Re: [oss-security] 432 Linux kernel CVEs Steffen Nurpmeso
• 2026/07/24 [oss-security] [vim-security] Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843 Christian Brabandt
• 2026/07/24 [oss-security] CVE-2026-58586: Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp Robert Rothenberg
• 2026/07/24 [oss-security] CVE-2026-49326: Apache HBase: Missing scanner instance owner check in thrift delegation service Duo Zhang
• 2026/07/24 Re: [oss-security] 432 Linux kernel CVEs Alan Coopersmith
• 2026/07/24 [oss-security] CVE-2026-45816: Apache NimBLE: NULL pointer dereference vulnerability in SMP LTK request Szymon Janc
• 2026/07/24 [oss-security] CVE-2026-45813: Apache NimBLE: Incorrect data validation in BASS add/modify source operation Szymon Janc
• 2026/07/24 [oss-security] [vim-security] Arbitrary Code Execution via Netrw Menu Construction in Vim < 9.2.0840 Christian Brabandt
• 2026/07/24 [oss-security] [vim-security] Stack Buffer Overflow in the Vim Socket Server in Vim < 9.2.0842 Christian Brabandt
• 2026/07/24 [oss-security] [vim-security] Heap Buffer Overflow in Text Property Handling in Vim < 9.2.0841 Christian Brabandt
• 2026/07/24 [oss-security] [vim-security] Arbitrary Code Execution via Shell Keyword Lookup in Vim < 9.2.0839 Christian Brabandt
• 2026/07/24 [oss-security] CVE-2026-46452: Apache NimBLE: Mesh Proxy SAR reassembly unbounded append and unchecked failure Szymon Janc
• 2026/07/24 [oss-security] CVE-2026-45811: Apache NimBLE: Buffer overflow in socket HCI transport Szymon Janc
• 2026/07/24 [oss-security] CVE-2026-45815: Apache NimBLE: Remote reachable assertion in ATT Read Multiple Variable Response handler Szymon Janc
• 2026/07/24 [oss-security] CVE-2026-45812: Apache NimBLE: OOB Read via sizeof(pointer) in Legacy Advertising Report Handler Szymon Janc
• 2026/07/24 [oss-security] CVE-2026-66144: Apache Neethi: Remote PolicyReference fetch lacks resource bounds Colm O hEigeartaigh
• 2026/07/24 [oss-security] CVE-2026-66143: Apache Neethi: Missing global alternative-output budget across policy computation paths Colm O hEigeartaigh
• 2026/07/24 [oss-security] CVE-2026-66142: Apache Neethi: Uncontrolled recursion in policy processing Colm O hEigeartaigh
• 2026/07/24 [oss-security] CVE-2026-63317: Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML Richard Zowalla
• 2026/07/24 Re: [oss-security] Knot Resolver 6.3.0 DNS-over-QUIC heap buffer overflow (RCE) Przemyslaw Frasunek
• 2026/07/24 Re: [oss-security] 432 Linux kernel CVEs John Haxby
• 2026/07/24 [oss-security] CVE-2026-16634: TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99 Robert Rothenberg
• 2026/07/24 [oss-security] libIEC61850: four MMS/GOOSE memory-safety vulnerabilities, including lab RCE Abhinav Agarwal
• 2026/07/24 [oss-security] Re: 432 Linux kernel CVEs Sultan Alsawaf
• 2026/07/24 [oss-security] Fwd: Heads-up: Upcoming important Samba security releases on 2026-07-28 Douglas Bagnall
• 2026/07/23 [oss-security] CVE-2026-16277 & CVE-2026-16461: buffer overflows in rpcinfo Alan Coopersmith
• 2026/07/23 [oss-security] [OSSA-2026-029] OpenStack Zaqar: EXTRA-SPEC header bypasses Keystone authentication (CVE-2026-pending) Goutham Pacha Ravi
• 2026/07/23 [oss-security] Knot Resolver 6.3.0 DNS-over-QUIC heap buffer overflow (RCE) Przemyslaw Frasunek
• 2026/07/23 [oss-security] [OSSA-2026-027] OpenStack Ironic Python Agent: Command execution via unsanitized config (CVE-2026-pending) Goutham Pacha Ravi
• 2026/07/23 [oss-security] [OSSA-2026-028] OpenStack Ironic Python Agent: Credential extraction via malicious container (CVE-2026-54422) Goutham Pacha Ravi
• 2026/07/23 Re: [oss-security] PowerDNS Security Advisory 2026-10 for PowerDNS Recursor: Multiple issues Otto Moerbeek
• 2026/07/23 Re: [oss-security] 432 Linux kernel CVEs Peter Gutmann
• 2026/07/23 [oss-security] Serendipity blog software security fixes in 2.6.1 (Username takeover, XSS, ...) Hanno Böck
• 2026/07/22 Re: [oss-security] 432 Linux kernel CVEs Steffen Nurpmeso
• 2026/07/22 Re: [oss-security] RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) Marco Benatto
• 2026/07/22 [oss-security] Re: RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) Qualys Security Advisory
• 2026/07/22 [oss-security] CVE-2026-13089: OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify Robert Rothenberg
• 2026/07/22 Re: [oss-security] 432 Linux kernel CVEs David A. Wheeler
• 2026/07/22 Re: [oss-security] CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling in Linux kernel Solar Designer
• 2026/07/22 [oss-security] RefluXFS: LPE in the Linux kernel via XFS reflink race (CVE-2026-64600) Qualys Security Advisory
• 2026/07/22 Re: [oss-security] 432 Linux kernel CVEs Marcus Meissner
• 2026/07/22 Re: [oss-security] 432 Linux kernel CVEs Stephan Verbücheln
• 2026/07/22 Re: [oss-security] 432 Linux kernel CVEs John Haxby
• 2026/07/22 Re: [oss-security] 432 Linux kernel CVEs Greg KH
• 2026/07/22 [oss-security] security release for Exim Jeremy Harris
• 2026/07/22 [oss-security] ISC has disclosed nine vulnerabilities in BIND 9 (CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321) Michał Kępień
• 2026/07/22 [oss-security] Unbound: 1.25.2 addresses multiple CVE items Yorgos Thessalonikefs
• 2026/07/22 [oss-security] PowerDNS Security Advisory 2026-10 for PowerDNS Recursor: Multiple issues Otto Moerbeek
• 2026/07/22 [oss-security] rsyslog v8.36.0 through v8.2606.0: imptcp regex-framing remote denial of service Rainer Gerhards
• 2026/07/22 [oss-security] PortProtonQt: Custom Polkit Rule Allows Escalation of NetworkManager and UDisks2 Privileges (CVE-2026-59678) Matthias Gerstner
• 2026/07/22 [oss-security] CVE-2026-54432+more: Roundcube XSS/SSRF/etc prior to 1.6.17/1.7.2 Valtteri Vuorikoski
• 2026/07/21 Re: [oss-security] 432 Linux kernel CVEs Peter Gutmann
• 2026/07/21 Re: [oss-security] 432 Linux kernel CVEs Jan Schaumann
• 2026/07/21 Re: [oss-security] 432 Linux kernel CVEs Steffen Nurpmeso
• 2026/07/21 [oss-security] Multiple vulnerabilities fixed in various Data::*::Shared modules for Perl Robert Rothenberg
• 2026/07/21 [oss-security] 432 Linux kernel CVEs Jan Schaumann
• 2026/07/21 [oss-security] libssh 0.12.1 and 0.11.5 security releases Alan Coopersmith
• 2026/07/21 [oss-security] CVE-2026-64609: Apache Fory: Out-of-Bounds Read via sun.misc.Unsafe in zero-copy java deserialization Chaokun Yang
• 2026/07/21 [oss-security] CVE-2026-64608: Apache Fory: Heap type confusion and out-of-bounds read/write in C++ compatible-mode field-skip paths Chaokun Yang
• 2026/07/21 [oss-security] CVE-2026-64606: Apache Fory: Class-registration bypass through an auto-admitted SerializedLambda capturing interface Chaokun Yang
• 2026/07/21 [oss-security] CVE-2026-60080: Apache Fory: Rust MetaString heap use-after-free Chaokun Yang
• 2026/07/21 [oss-security] Re: LPE in snapd and other vulnerabilities Qualys Security Advisory
• 2026/07/21 [oss-security] LPE in snapd and other vulnerabilities Eduardo Barretto
• 2026/07/20 [oss-security] CVE-2026-58624: Apache MINA SSHD: Remote execution of JGit commands can write files on the server Thomas Wolf
• 2026/07/20 [oss-security] CVE-2026-56624: Apache MINA SSHD: SSH certificate options lack validations Thomas Wolf
• 2026/07/20 [oss-security] CVE-2026-56623: Apache MINA SSHD: Path traversal in org.apache.sshd:sshd-git on Windows Thomas Wolf
• 2026/07/20 [oss-security] CVE-2026-56452: Apache MINA SSHD: Path traversal in SCP file reception Thomas Wolf
• 2026/07/20 Re: [oss-security] dnsmasq vulnerabilities, including attacker DNS redirect, privilege escalation, and heap manipulation Alan Coopersmith
• 2026/07/20 [oss-security] CVE-2026-64194: Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains Robert Rothenberg
• 2026/07/20 [oss-security] CVE-2026-64193: Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR Robert Rothenberg
• 2026/07/20 [oss-security] CVE-2026-63071: Apache Syncope: RCE via Groovy Sandbox bypass Francesco Chicchiriccò
• 2026/07/20 [oss-security] CVE-2026-62418: Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Francesco Chicchiriccò
• 2026/07/20 [oss-security] CVE-2026-62183: Apache Syncope: User self-service privilege escalation Francesco Chicchiriccò
• 2026/07/20 [oss-security] CVE-2026-57308: Apache Syncope: SQL injection vulnerability in Audit Events search Francesco Chicchiriccò
• 2026/07/20 [oss-security] CVE-2026-53421: Apache Syncope: Remote Code Execution via Scripted Connector Francesco Chicchiriccò
• 2026/07/20 [oss-security] CVE-2026-53405: Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask Francesco Chicchiriccò
• 2026/07/20 [oss-security] CVE-2026-13577: Dancer2 versions through 2.1.0 for Perl generate insecure session ids when CSPRNG modules are unavailable Robert Rothenberg
• 2026/07/20 [oss-security] CVE-2026-6656: Crypt::Password versions through 0.28 for Perl are susceptible to timing attacks Robert Rothenberg
• 2026/07/20 [oss-security] CVE-2026-16235: Crypt::Password versions through 0.28 for Perl generate insecure random values for salts Robert Rothenberg
• 2026/07/20 [oss-security] CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES fragment-boundary handling in Linux kernel Wongi Lee
• 2026/07/20 [oss-security] CVE-2026-61548: rsyslog mmpstrucdata stack overflow Rainer Gerhards
• 2026/07/18 [oss-security] User prompt injection (CSRF) of the llama-server's Web UI (llama.cpp) Gabriel Corona
• 2026/07/18 [oss-security] OpenSSL "HollowByte" DoS via attacker-controlled memory allocation size in glibc Jan Schaumann
• 2026/07/17 [oss-security] Cyrus IMAP 3.12.3 fixed 9 CVEs Alan Coopersmith
• 2026/07/17 [oss-security] 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability Alan Coopersmith
• 2026/07/17 [oss-security] CVE-2026-9537: Mojo::JWT versions before 1.02 for Perl verify HMAC signatures with a non-constant-time string comparison Robert Rothenberg
• 2026/07/17 [oss-security] CVE-2026-14741: HTTP::Date versions before 6.08 for Perl allow CPU exhaustion via polynomial regex backtracking in parse_date Robert Rothenberg
• 2026/07/17 [oss-security] CVE-2026-13082: GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets Robert Rothenberg
• 2026/07/17 [oss-security] CVE-2026-13410: Dancer::Plugin::Auth::Google versions through 0.07 for Perl have TLS verification disabled Robert Rothenberg
• 2026/07/17 Re: [oss-security] SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 Matthias Gerstner
• 2026/07/16 [oss-security] CVE-2026-62764: Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions Christopher Tubbs
• 2026/07/16 [oss-security] CVE-2026-59173: Apache Traffic Server is vulnerable to stalled HTTP/2 flow-control Masakazu Kitajo
• 2026/07/16 [oss-security] CVE-2026-57077: YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len Paul Johnson
• 2026/07/16 [oss-security] CVE-2026-57076: YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor Paul Johnson
• 2026/07/16 [oss-security] CVE-2026-57075: YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec Paul Johnson
• 2026/07/16 [oss-security] CVE-2026-13713: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack Paul Johnson
• 2026/07/16 [oss-security] CERT VU#885548 - Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions Alan Coopersmith
• 2026/07/16 [oss-security] CVE-2026-13397: HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes Robert Rothenberg
• 2026/07/16 [oss-security] CVE-2026-57073: HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead Robert Rothenberg
• 2026/07/16 [oss-security] CVE-2026-13401: XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes Robert Rothenberg
• 2026/07/16 [oss-security] CVE-2026-57074: XML::Bare versions through 0.53 for Perl have an unbounded character lookahead Robert Rothenberg
• 2026/07/15 [oss-security] Multiple vulnerabilities in ntfs-3g Rostislav
• 2026/07/15 [oss-security] CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability Stefan Bodewig
• 2026/07/15 [oss-security] SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 Matthias Gerstner
• 2026/07/14 [oss-security] CVE-2026-57821: Apache Fineract: Office list: SQL Injection via Subquery in orderBy Terence Monteiro
• 2026/07/14 [oss-security] CVE-2026-56287: Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure Terence Monteiro
• 2026/07/14 [oss-security] CVE-2026-35152: Apache Fineract: SQL injection in runreports endpoint Terence Monteiro
• 2026/07/14 [oss-security] CVE-2026-15747: Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle Stig Palmquist
• 2026/07/14 [oss-security] CVE-2026-15392: DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location Robert Rothenberg
• 2026/07/14 [oss-security] CVE-2026-60081: DBI::ProfileData versions before 1.651 for Perl do not limit the path index Robert Rothenberg
• 2026/07/14 [oss-security] CVE-2026-60082: DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row Robert Rothenberg
• 2026/07/14 [oss-security] Xen Security Advisory 498 v2 (CVE-2026-42491) - XAPI: Missing TLS verification in some SDKs Xen . org security team
• 2026/07/14 Re: [oss-security] new af_alg exploit in the wild? Simon McVittie
• 2026/07/14 [oss-security] CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read Maxim Solodovnik
• 2026/07/14 [oss-security] CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text Robert Rothenberg
• 2026/07/14 [oss-security] CVE-2026-59084: Apache Tomcat: EncryptInterceptor requirements not clearly documented Mark Thomas
• 2026/07/14 [oss-security] CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass Mark Thomas
• 2026/07/13 [oss-security] CVE-2026-62393: Apache Kylin: Improper authorization in job information retrieval Li Yang
• 2026/07/13 [oss-security] CVE-2026-62392: Apache Kylin: OS Command Injection via Async Query API Li Yang
• 2026/07/13 [oss-security] CVE-2026-62390: Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API Li Yang
• 2026/07/13 [oss-security] CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API Mingyu Chen
• 2026/07/13 Re: [oss-security] new af_alg exploit in the wild? Solar Designer
• 2026/07/13 Re: [oss-security] new af_alg exploit in the wild? Vincent Lefevre
• 2026/07/13 [oss-security] new af_alg exploit in the wild? Bernd Zeimetz
• 2026/07/13 [oss-security] 2 CVEs Crypt::OpenSSL::X509 versions before 2.1.3 Timothy Legge
• 2026/07/13 [oss-security] CVE-2026-57433: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record Stig Palmquist
• 2026/07/13 [oss-security] CVE-2026-57432: Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack Stig Palmquist
• 2026/07/13 [oss-security] CVE-2026-13221: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk Stig Palmquist
• 2026/07/13 [oss-security] CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (access_control privilege escalation via resource_name() collision) Vincent Beck
• 2026/07/13 [oss-security] CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key verification Vincent Beck
• 2026/07/12 [oss-security] CVE-2026-49876: Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and cloud metadata endpoints via unvalidated job template URIs Yu Qi
• 2026/07/12 [oss-security] CVE-2026-41041: Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL construction, enabling path traversal to unintended API endpoints. Jerry Shao
• 2026/07/12 Re: [oss-security] Skillable SCORM launch: userId parameter not validated against session token allows allocation bypass and cross-user DoS Solar Designer
• 2026/07/12 [oss-security] Skillable SCORM launch: userId parameter not validated against session token allows allocation bypass and cross-user DoS gregdurys . security
• 2026/07/10 [oss-security] CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() Piotr Karwasz
• 2026/07/10 [oss-security] CVE-2026-40454: Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malformed server data Haonan Hou
• 2026/07/10 [oss-security] CVE-2026-40452: Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users Haonan Hou
• 2026/07/10 [oss-security] CVE-2026-40009: Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor Haonan Hou

• Earlier messages
• Later messages