oss-security  

Messages by Date

• 2026/10/19 [oss-security] CVE-2026-88900: Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution Andrea Cosentino
• 2026/10/19 [oss-security] Linux KVM/x86: stale SMM MMIO cache bypasses write tracking Jinu Kim
• 2026/10/18 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) David A. Wheeler
• 2026/10/18 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Peter Gutmann
• 2026/10/18 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Jan Schaumann
• 2026/10/18 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Martin Steigerwald
• 2026/10/18 [oss-security] CVE-2026-78497: JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval Robert Rothenberg
• 2026/10/18 [oss-security] Apache Camel: 38 CVEs fixed in 4.18.5, 4.22.1 and 4.23.0 Andrea Cosentino
• 2026/10/17 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Rihards Simanovics
• 2026/10/17 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Peter Gutmann
• 2026/10/17 [oss-security] CVE-2025-55653: Divide by Zero in GPAC/MP4Box via gf_parse_lfrac on crafted MP4 with zero-denominator fraction Alexander A. Shvedov
• 2026/10/17 Re: [oss-security] FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) Alan Coopersmith
• 2026/10/17 [oss-security] CVE-2025-55640: Heap Buffer Overflow in GPAC/MP4Box via stbl_AddSize on crafted MP4 with corrupted sample metadata Alexander A. Shvedov
• 2026/10/16 Re: [oss-security] FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) eddyflores100
• 2026/10/16 [oss-security] Text::CSV_XS versions before 1.65 for Perl (8 CVEs) Stig Palmquist
• 2026/10/16 Re: [oss-security] Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) Solar Designer
• 2026/10/16 [oss-security] Fwd: X.Org Security Advisory: multiple security issues in X.Org X client libraries Alan Coopersmith
• 2026/10/16 [oss-security] Infinity Core: Linux Kernel Core LPEs Hyunwoo Kim
• 2026/10/16 [oss-security] CVE-2026-104715: cifs-utils 4.2-7.8 mount-option injection in mount.cifs Bharath SM
• 2026/10/15 [oss-security] CVE-2026-108766: Apache Kylin: missing JDBC-config authorization Li Yang
• 2026/10/15 [oss-security] CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication Enxin Xie
• 2026/10/15 [oss-security] CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion Li Yang
• 2026/10/15 [oss-security] CVE-2026-108833: Apache Kylin: default startup profile miss security settings Li Yang
• 2026/10/15 [oss-security] CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement Li Yang
• 2026/10/15 [oss-security] CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard Li Yang
• 2026/10/15 [oss-security] CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue Li Yang
• 2026/10/15 [oss-security] CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection Li Yang
• 2026/10/15 [oss-security] CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization Li Yang
• 2026/10/15 [oss-security] CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump Li Yang
• 2026/10/15 [oss-security] CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF Li Yang
• 2026/10/15 [oss-security] CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass Li Yang
• 2026/10/15 [oss-security] CVE-2026-108743: Apache Kylin: spark job OS command injection Li Yang
• 2026/10/15 [oss-security] CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) Li Yang
• 2026/10/15 [oss-security] CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController Li Yang
• 2026/10/15 [oss-security] CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation Li Yang
• 2026/10/15 [oss-security] CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup Li Yang
• 2026/10/15 [oss-security] CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env Li Yang
• 2026/10/15 [oss-security] CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass Li Yang
• 2026/10/15 [oss-security] CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints Li Yang
• 2026/10/15 [oss-security] CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization Li Yang
• 2026/10/15 [oss-security] CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure Li Yang
• 2026/10/15 [oss-security] CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read Jarek Potiuk
• 2026/10/15 [oss-security] CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token Jarek Potiuk
• 2026/10/15 [oss-security] CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default Jarek Potiuk
• 2026/10/15 [oss-security] CVE-2026-94134: Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default Jarek Potiuk
• 2026/10/15 Re: [oss-security] FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) Solar Designer
• 2026/10/15 [oss-security] FOLLOW-UP: taikotalent.xyz fake-recruiter trojan — RESOLVED (registrar clientHold 2026-10-10) eddyflores100
• 2026/10/15 [oss-security] [vim-security] Ex Command Execution via Cargo Quickfix Hooks in Vim < 9.2.1201 Christian Brabandt
• 2026/10/15 [oss-security] linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999) Jan Schaumann
• 2026/10/15 [oss-security] Re: Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup Tomasz Kaye
• 2026/10/15 [oss-security] Re: Godot 4.x: heap out-of-bounds write in Radiance HDR image loader Tomasz Kaye
• 2026/10/15 [oss-security] Re: Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader Tomasz Kaye
• 2026/10/15 [oss-security] Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup Tomasz Kaye
• 2026/10/14 Re: [oss-security] Incomplete fix for Emacs CVE-2026-79992 Salvatore Bonaccorso
• 2026/10/14 [oss-security] NSD 4.15.3 security release Willem Toorop
• 2026/10/14 [oss-security] Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595) Oleh Konko
• 2026/10/14 [oss-security] Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader Tomasz Kaye
• 2026/10/14 [oss-security] Upcoming Node.js security release 2026/10/21 Antoine du Hamel
• 2026/10/14 [oss-security] Godot 4.x: heap out-of-bounds write in Radiance HDR image loader Tomasz Kaye
• 2026/10/14 [oss-security] DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries Maxime Coquelin
• 2026/10/14 Re: [oss-security] libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 Sam James
• 2026/10/14 [oss-security] [SECURITY ADVISORIES] curl 8.23.0 Daniel Stenberg
• 2026/10/14 Re: [oss-security] Incomplete fix for Emacs CVE-2026-79992 Sam James
• 2026/10/13 [oss-security] CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape fourie
• 2026/10/13 [oss-security] Hex 2.5.2 released with security fixes Alan Coopersmith
• 2026/10/13 [oss-security] rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) Rainer Gerhards
• 2026/10/13 [oss-security] CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan
• 2026/10/13 [oss-security] Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround Xen . org security team
• 2026/10/13 [oss-security] Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states Xen . org security team
• 2026/10/13 [oss-security] Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 Thomas GERBET
• 2026/10/13 [oss-security] Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race Xen . org security team
• 2026/10/13 [oss-security] Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush Xen . org security team
• 2026/10/13 [oss-security] Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() Xen . org security team
• 2026/10/13 [oss-security] Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak Xen . org security team
• 2026/10/13 [oss-security] Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems Xen . org security team
• 2026/10/13 [oss-security] Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update Xen . org security team
• 2026/10/12 [oss-security] Fwd: Announcing FreeType version 2.15.0 Alan Coopersmith
• 2026/10/12 [oss-security] [vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 Christian Brabandt
• 2026/10/12 [oss-security] [vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 Christian Brabandt
• 2026/10/12 [oss-security] Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460) Nebojša Jaćović
• 2026/10/12 [oss-security] CVE-2026-92116: Apache Allura: OAuth1 missing callback validation Dave Brondsema
• 2026/10/12 [oss-security] CVE-2026-92119: Apache Allura: REST API Mass Assignment Dave Brondsema
• 2026/10/12 [oss-security] CVE-2026-92120: Apache Allura: Oauth1 Replay Attack Dave Brondsema
• 2026/10/12 [oss-security] Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459) Nebojša Jaćović
• 2026/10/11 [oss-security] Incomplete fix for Emacs CVE-2026-79992 Sean Whitton
• 2026/10/10 [oss-security] CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list Robert Rothenberg
• 2026/10/10 [oss-security] CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch Lee Rhodes
• 2026/10/10 [oss-security] CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch Lee Rhodes
• 2026/10/10 [oss-security] CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument Robert Rothenberg
• 2026/10/10 [oss-security] CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
• 2026/10/10 [oss-security] CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
• 2026/10/10 [oss-security] CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Lee Rhodes
• 2026/10/09 [oss-security] 3 Vulnerabilities in GNU Aspell before 0.60.8.3 Alan Coopersmith
• 2026/10/09 [oss-security] CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Colm O hEigeartaigh
• 2026/10/09 [oss-security] mutt 2.4.3 released, fixes CVE-2026-107570 Alan Coopersmith
• 2026/10/09 [oss-security] CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic Colm O hEigeartaigh
• 2026/10/09 [oss-security] Unfixed vulnerabilities in Cyrus SASL Alan Coopersmith
• 2026/10/09 [oss-security] Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets Xen . org security team
• 2026/10/09 [oss-security] CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE for illumos and distros: VMM/BHYVE Dan McDonald
• 2026/10/09 [oss-security] Multiple CVEs for illumos and distros: door server processes Dan McDonald
• 2026/10/09 [oss-security] CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git Andrea Cosentino
• 2026/10/09 [oss-security] CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml Andrea Cosentino
• 2026/10/09 Re: [oss-security] OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) Stuart Henderson
• 2026/10/09 [oss-security] CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security Colm O hEigeartaigh
• 2026/10/09 [oss-security] CVE-2026-79650: Apache CXF: OIDC RP Open Redirect Colm O hEigeartaigh
• 2026/10/08 [oss-security] [OSSN-0110] Ironic can leak basic auth credentials to image server Jay Faulkner
• 2026/10/08 [oss-security] [OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147)) Jeremy Stanley
• 2026/10/08 [oss-security] Fwd: Vulnerabilities in golang.org/x/net Alan Coopersmith
• 2026/10/08 [oss-security] Fwd: Go 1.27.2 and Go 1.26.9 are released Alan Coopersmith
• 2026/10/08 [oss-security] OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) TheSecguy
• 2026/10/07 [oss-security] CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials Wenjun Ruan
• 2026/10/07 Re: [oss-security] CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Demi Marie Obenour
• 2026/10/07 [oss-security] CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information Wenjun Ruan
• 2026/10/07 [oss-security] CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords Wenjun Ruan
• 2026/10/07 [oss-security] CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint Wenjun Ruan
• 2026/10/07 [oss-security] CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint Wenjun Ruan
• 2026/10/07 [oss-security] CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） Wenjun Ruan
• 2026/10/07 [oss-security] tor-0.4.9.14 released Sam James
• 2026/10/07 [oss-security] [OSSN-0109] Cross-project metric association bypass in Gnocchi Goutham Pacha Ravi
• 2026/10/07 [oss-security] Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1 Goutham Pacha Ravi
• 2026/10/07 [oss-security] CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File Jinwoo Hwang
• 2026/10/07 [oss-security] [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pending) Goutham Pacha Ravi
• 2026/10/07 [oss-security] CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Julian Reschke
• 2026/10/07 [oss-security] CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Julian Reschke
• 2026/10/07 [oss-security] CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery Wilfred Spiegelenburg
• 2026/10/07 [oss-security] CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation Wilfred Spiegelenburg
• 2026/10/07 [oss-security] CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name Wilfred Spiegelenburg
• 2026/10/06 [oss-security] CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded Jan Friedrich
• 2026/10/06 [oss-security] FW: X.Org Security Advisory: multiple security issues in X.Org X server Peter Hutterer
• 2026/10/06 [oss-security] CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass Michael Smith
• 2026/10/06 [oss-security] CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans Michael Smith
• 2026/10/06 [oss-security] CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths Michael Smith
• 2026/10/06 [oss-security] CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content Jan Friedrich
• 2026/10/06 [oss-security] CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records Jan Friedrich
• 2026/10/06 [oss-security] CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter Jan Friedrich
• 2026/10/06 [oss-security] CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Jan Friedrich
• 2026/10/06 [oss-security] CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records Jan Friedrich
• 2026/10/06 [oss-security] CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS Gary D. Gregory
• 2026/10/06 [oss-security] CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser Gary D. Gregory
• 2026/10/06 [oss-security] CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
• 2026/10/06 [oss-security] Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 Sarah Boyce
• 2026/10/06 [oss-security] Announce: OpenSSH 10.6 released Damien Miller
• 2026/10/05 [oss-security] CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one Timothy Legge
• 2026/10/05 [oss-security] Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released Chad Dougherty
• 2026/10/05 [oss-security] libexpat 2.9.0 fixes two vulnerabilities Sebastian Pipping
• 2026/10/05 Re: [oss-security] cloud computing provider disclosures Jeremy Stanley
• 2026/10/05 Re: [oss-security] cloud computing provider disclosures Jan Schaumann
• 2026/10/05 [oss-security] CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests Lukasz Lenart
• 2026/10/05 [oss-security] CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin Lukasz Lenart
• 2026/10/05 [oss-security] CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters Lukasz Lenart
• 2026/10/05 [oss-security] CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper Lukasz Lenart
• 2026/10/05 [oss-security] CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution Stig Palmquist
• 2026/10/05 [oss-security] CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names Robert Rothenberg
• 2026/10/05 [oss-security] CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes Stig Palmquist
• 2026/10/05 [oss-security] [cups] Multiple security fixes in incoming new version 2.4.20 Zdenek Dohnal
• 2026/10/05 [oss-security] openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder) Security @ Red Eagle Tech
• 2026/10/04 Re: [oss-security] cloud computing provider disclosures Katie
• 2026/10/04 Re: [oss-security] cloud computing provider disclosures Aaron Rainbolt
• 2026/10/04 Re: [oss-security] cloud computing provider disclosures Demi Marie Obenour
• 2026/10/04 Re: [oss-security] cloud computing provider disclosures Jonathan Wright
• 2026/10/04 [oss-security] cloud computing provider disclosures Jan Schaumann
• 2026/10/04 [oss-security] Apache Thrift 0.25.0: 61 CVEs fixed (combined announcement) Jens Geyer
• 2026/10/02 [oss-security] CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values Emmanuel Lécharny
• 2026/10/02 [oss-security] CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords Emmanuel Lécharny
• 2026/10/02 [oss-security] CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS Emmanuel Lécharny
• 2026/10/02 [oss-security] CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements Emmanuel Lécharny
• 2026/10/02 [oss-security] CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder Emmanuel Lécharny
• 2026/10/02 [oss-security] CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode Emmanuel Lécharny
• 2026/10/02 [oss-security] CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Dave Fisher
• 2026/10/02 [oss-security] CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920) Masakazu Kitajo
• 2026/10/01 [oss-security] CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM Eric Covener

• Earlier messages
• Later messages