oss-security  

Messages by Thread

• [oss-security] CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack Eric Covener
• [oss-security] CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack Eric Covener
• [oss-security] CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling Eric Covener
• [oss-security] CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure Eric Covener
• [oss-security] CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow Eric Covener
• [oss-security] CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling Eric Covener
• [oss-security] CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function Eric Covener
• [oss-security] CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access Eric Covener
• [oss-security] CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy Eric Covener
• [oss-security] CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} Eric Covener
• [oss-security] CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char Eric Covener
• [oss-security] CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack Eric Covener
• [oss-security] CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect Eric Covener
• [oss-security] CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service Eric Covener
• [oss-security] CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow Eric Covener
• [oss-security] CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin Abhishek Choudhary
• [oss-security] CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch Abhishek Choudhary
• [oss-security] CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue Abhishek Choudhary
• [oss-security] CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol Stig Palmquist
• [oss-security] CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp Stig Palmquist
• [oss-security] CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory Abhishek Choudhary
• [oss-security] CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth Abhishek Choudhary
• [oss-security] CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation Abhishek Choudhary
• [oss-security] CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output Abhishek Choudhary
• [oss-security] CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening James Netherton
• [oss-security] CPython [CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts Alan Coopersmith
• [oss-security] CPython [CVE-2026-19553] SSLContext.wrap_bio() missing validation of server_hostname parameter Alan Coopersmith
• [oss-security] CVE-2026-102510: Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths Christofer Dutz
• [oss-security] CVE-2026-85532: Apache WSS4J: Insufficient Validation of Derived-Key Parameters Colm O hEigeartaigh
• [oss-security] CVE-2026-80490: Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified Robert Rothenberg
• [oss-security] CVE-2026-92899: Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce Colm O hEigeartaigh
• [oss-security] CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade Christofer Dutz
• [oss-security] CVE-2026-95616: Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions Colm O hEigeartaigh
• [oss-security] CVE-2026-92121: Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference Colm O hEigeartaigh
• [oss-security] CVE-2026-89238: Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection Colm O hEigeartaigh
• [oss-security] CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass Colm O hEigeartaigh
• [oss-security] CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. Colm O hEigeartaigh
• [oss-security] CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them Christofer Dutz
• [oss-security] CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser Christofer Dutz
• [oss-security] Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries Alan Coopersmith
• [oss-security] Linux KVM/x86 (tested on 6.1.74): guest-triggered host panic via SMM shadow MMU Jinu Kim
• [oss-security] CPython [CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory Alan Coopersmith
• [oss-security] CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap Thomas Wolf
• [oss-security] CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server Thomas Wolf
• [oss-security] CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective Thomas Wolf
• [oss-security] CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension Thomas Wolf
• [oss-security] CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies Thomas Wolf
• [oss-security] CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read Thomas Wolf
• [oss-security] CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server Thomas Wolf
• [oss-security] CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification Thomas Wolf
• [oss-security] Fwd: groff 1.24.2 released Alan Coopersmith
• [oss-security] CVE-2026-71897: Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints Wenjun Ruan
• [oss-security] CVE-2026-81569: Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution Wenjun Ruan
• [oss-security] CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain Shahar Epstein
• [oss-security] CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource Wenjun Ruan
• [oss-security] OpenSSL Security Advisory [29th September 2026] Tomas Mraz
• [oss-security] [NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read advisories
• [oss-security] [NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Service advisories
• [oss-security] [NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read advisories
• [oss-security] CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials Jean-Baptiste Onofré
• [oss-security] CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin Wenjun Ruan
• [oss-security] CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths Wenjun Ruan
• [oss-security] CVE-2026-71899: Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure Wenjun Ruan
• [oss-security] "several" CVEs in latest Debian linux security advisory DSA 6528-1 Jan Schaumann
  • Re: [oss-security] "several" CVEs in latest Debian linux security advisory DSA 6528-1 Zdenek Salvet
• [oss-security] CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions Wenjun Ruan
• [oss-security] CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs Shahar Epstein
• [oss-security] CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker Colm O hEigeartaigh
• [oss-security] CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures Colm O hEigeartaigh
• [oss-security] CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes Colm O hEigeartaigh
• [oss-security] CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag Shahar Epstein
• [oss-security] CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names Shahar Epstein
• [oss-security] [NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service advisories
• [oss-security] JIT buffer overflow fixed in libpcre2-10.49 Sam James
  • Re: [oss-security] JIT buffer overflow fixed in libpcre2-10.49 Gabriel Ravier
• [oss-security] libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 Cosmin Truta
  • Re: [oss-security] libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 Sam James
  • Re: [oss-security] libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 Sam James
• [oss-security] Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration Muhammad Arslan Official
  • Re: [oss-security] Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration Michael Straßberger
  • Re: [oss-security] Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration Daniel Ziegenberg
  • Re: [oss-security] Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration Alan Coopersmith
• [oss-security] WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 Adrian Perez de Castro
  • [oss-security] Re: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 Adrian Perez de Castro
• [oss-security] CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv Robert Rothenberg
• [oss-security] CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations Jean-Baptiste Onofré
• [oss-security] CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin Jean-Baptiste Onofré
• [oss-security] CVE-2026-85644: XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference Robert Rothenberg
• [oss-security] CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName Robert Rothenberg
• [oss-security] CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create Jean-Baptiste Onofré
• [oss-security] CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation Jean-Baptiste Onofré
• [oss-security] The GNU C Library security advisory update for 2026-09-28 Siddhesh Poyarekar
• [oss-security] Flatpak 1.18.4 fixes multiple security vulnerabilities Simon McVittie
• [oss-security] CVE-2026-85499: Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy Hongtao Gao
• [oss-security] crontab(1) silently truncates file path arguments >=100 chars Vincent Lefevre
• [oss-security] CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) Jean-Baptiste Onofré
• [oss-security] CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP login modules Jean-Baptiste Onofré
• [oss-security] [kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes Vyom Yadav
• [oss-security] CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction Collin Funk
• [oss-security] CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX Haitam Lazaar
  • Re: [oss-security] CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX Simon McVittie
• [oss-security] CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint David M. Johnson
• [oss-security] CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator David M. Johnson
• [oss-security] CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments David M. Johnson
• [oss-security] CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL David M. Johnson
• [oss-security] CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links David M. Johnson
• [oss-security] CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type David M. Johnson
• [oss-security] CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import David M. Johnson
• [oss-security] CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files David M. Johnson
• [oss-security] CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering David M. Johnson
• [oss-security] CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter David M. Johnson
• [oss-security] CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI David M. Johnson
• [oss-security] CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation David M. Johnson
• [oss-security] CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed David M. Johnson
• [oss-security] CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity David M. Johnson
• [oss-security] CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers David M. Johnson
• [oss-security] CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser David M. Johnson
• [oss-security] CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs David M. Johnson
• [oss-security] CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups David M. Johnson
• [oss-security] [NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTEM advisories
• [oss-security] [NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory advisories
• [oss-security] CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it Timothy Legge
• [oss-security] CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify the client secret Timothy Legge
• [oss-security] CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party Timothy Legge
• [oss-security] CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication Daniil Kirilyuk
• [oss-security] CVE-2026-92608: Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 Daniil Kirilyuk
• [oss-security] CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering Daniil Kirilyuk
• [oss-security] CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing Daniil Kirilyuk
• [oss-security] CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder Daniil Kirilyuk
• [oss-security] CVE-2026-92550: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder Daniil Kirilyuk
• [oss-security] XSS vulnerability in <ansi2html-1.9.4 Sam James
  • Re: [oss-security] XSS vulnerability in <ansi2html-1.9.4 Sebastian Pipping
• [oss-security] CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL Robert Rothenberg
• [oss-security] CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone Robert Rothenberg
  • Re: [oss-security] CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone Robert Rothenberg
• [oss-security] CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key Jarek Potiuk
• [oss-security] [OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404) Goutham Pacha Ravi
• [oss-security] [OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149) Goutham Pacha Ravi
• [oss-security] CVE-2026-96512: sudo: TZ still affects NOTBEFORE/NOTAFTER Ermenson Junior
• [oss-security] CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations Wenjun Ruan
• [oss-security] Fwd: Tor Project Forum: Security Release 0.4.9.13 Sam James
• [oss-security] [kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion Nathan Herz
• [oss-security] [kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation Nathan Herz
• [oss-security] CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded Mark Thomas
• [oss-security] CVE-2026-86246: Apache Tomcat Native: Insecure OpenSSL options enabled Mark Thomas
• [oss-security] CVE-2026-86243: Apache Tomcat Native: DoS via TLS handshake Mark Thomas
• [oss-security] CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate Mark Thomas
• [oss-security] CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up Mark Thomas
• [oss-security] CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled Mark Thomas
• [oss-security] CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout Mark Thomas
• [oss-security] CVE-2026-78437: Apache Tomcat: HTTP/2 DoS via malformed request Mark Thomas
• [oss-security] CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body Mark Thomas
• [oss-security] CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close Mark Thomas
• [oss-security] CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request Mark Thomas
• [oss-security] CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests Mark Thomas
• [oss-security] CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints Mark Thomas
• [oss-security] CVE-2026-75973: Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured Mark Thomas
• [oss-security] CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore Mark Thomas
• [oss-security] CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref() Joerg Hoh
• [oss-security] CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource Joerg Hoh
• [oss-security] CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence Joerg Hoh
• [oss-security] CVE-2026-92001: Apache Sling XSS: Missing parser resource limits Joerg Hoh
• [oss-security] CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin Joerg Hoh
• [oss-security] CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms Joerg Hoh
• [oss-security] CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl Joerg Hoh
• [oss-security] CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution Calvin Kirs
• [oss-security] CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service Calvin Kirs
• [oss-security] CVE-2026-82331: Apache BuildStream: tar source extraction escape Jürg Billeter
• [oss-security] npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence) ezraax
• [oss-security] xdg-dbus-proxy 0.1.9 fixes sandbox escape CVE-2026-94422 Simon McVittie
• [oss-security] Vulnerabilities in ntfs-3g Rostislav
• [oss-security] CVE-2026-94184: some builds of fetchmail 6.6.6 and older vulnerable to remote code execution in NTLM authentication client (revised fetchmail-SA-2026-01) Matthias Andree
• [oss-security] CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL Robert Rothenberg
  • Re: [oss-security] CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL Sam James
  • Re: [oss-security] CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL Robert Rothenberg
• [oss-security] The GNU C Library security advisories update for 2026-09-22 Carlos O'Donell
• [oss-security] rsyslog imdtls permitted-peer authorization bypass Rainer Gerhards
• [oss-security] CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode Paul Johnson
• [oss-security] CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii Paul Johnson
• [oss-security] CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode Paul Johnson
• [oss-security] CVE-2026-87079: Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode Paul Johnson
• [oss-security] CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode Paul Johnson
• [oss-security] CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode Paul Johnson
• [oss-security] CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta accumulator in encode_punycode Paul Johnson
• [oss-security] CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode Paul Johnson
• [oss-security] libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling) Sebastian Pipping
• [oss-security] New OpenSSL Releases Norbert Pócs
• [oss-security] CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler Stig Palmquist
• [oss-security] CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array Stig Palmquist
• [oss-security] CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks Stig Palmquist
• [oss-security] CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler Stig Palmquist
• [oss-security] CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches the shell in _sendmail_pipe Stig Palmquist
• [oss-security] [OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CVE-2026-93854) Goutham Pacha Ravi
• [oss-security] [OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-pending) Goutham Pacha Ravi
  • [oss-security] [OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-2026-94572, CVE-2026-94571) Goutham Pacha Ravi
• [oss-security] CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry Rahul Vats
• [oss-security] CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation Rahul Vats
• [oss-security] CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter Rahul Vats
• [oss-security] CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 Emmanuel Lécharny
• [oss-security] CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate Emmanuel Lécharny

• Earlier messages
• Later messages