oss-sec: by date
RSS Feed
About List
All Lists
Previous period
164 messages
starting Oct 01 26 and
ending Oct 14 26
Date index |
Thread index |
Author index
Thursday, 01 October
CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening James Netherton
CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output Abhishek Choudhary
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation Abhishek Choudhary
CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth Abhishek Choudhary
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin Abhishek Choudhary
CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory Abhishek Choudhary
CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch Abhishek Choudhary
CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue Abhishek Choudhary
CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol Stig Palmquist
CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp Stig Palmquist
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories Eric Covener
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow Eric Covener
CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service Eric Covener
CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect Eric Covener
CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack Eric Covener
CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char Eric Covener
CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} Eric Covener
CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content Eric Covener
CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy Eric Covener
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access Eric Covener
CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM Eric Covener
CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function Eric Covener
CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling Eric Covener
CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow Eric Covener
CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure Eric Covener
CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling Eric Covener
CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack Eric Covener
CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack Eric Covener
CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure Eric Covener
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow Eric Covener
Friday, 02 October
CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920) Masakazu Kitajo
CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Dave Fisher
CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode Emmanuel Lécharny
CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder Emmanuel Lécharny
CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements Emmanuel Lécharny
CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS Emmanuel Lécharny
CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords Emmanuel Lécharny
CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values Emmanuel Lécharny
Sunday, 04 October
Apache Thrift 0.25.0: 61 CVEs fixed (combined announcement) Jens Geyer
cloud computing provider disclosures Jan Schaumann
Re: cloud computing provider disclosures Jonathan Wright
Re: cloud computing provider disclosures Demi Marie Obenour
Re: cloud computing provider disclosures Aaron Rainbolt
Re: cloud computing provider disclosures Katie
Monday, 05 October
openjpeg 2.4.0 through 2.5.4 and git master: heap buffer overflow in opj_dwt_encode_and_deinterleave_v() (reversible 5/3 forward DWT, encoder) Security @ Red Eagle Tech
[cups] Multiple security fixes in incoming new version 2.4.20 Zdenek Dohnal
CVE-2019-25777: YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution Stig Palmquist
CVE-2017-20285: YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes Stig Palmquist
CVE-2026-19954: Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names Robert Rothenberg
CVE-2026-104711: Apache Struts: OGNL injection in the legacy RESTful action mapper Lukasz Lenart
CVE-2026-104712: Apache Struts: Disproportionate response size when rendering BigDecimal request parameters Lukasz Lenart
CVE-2026-104713: Apache Struts: Unbounded request body read in the REST plugin Lukasz Lenart
CVE-2026-104714: Apache Struts: Shared message formatter exposes date and time values across concurrent requests Lukasz Lenart
Re: cloud computing provider disclosures Jan Schaumann
Re: cloud computing provider disclosures Jeremy Stanley
libexpat 2.9.0 fixes two vulnerabilities Sebastian Pipping
Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released Chad Dougherty
CVE-2026-104380: Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one Timothy Legge
Tuesday, 06 October
Announce: OpenSSH 10.6 released Damien Miller
Django CVE-2026-77050, CVE-2026-84429, CVE-2026-87890, and CVE-2026-87975 Sarah Boyce
CVE-2026-96659: Foreman: excessive Viewer permissions on preview (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-96658: Foreman: Safemode bypass leading to RCE (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-56098: Katello: Registry Proxy authorization bypass (fixed in 4.21.2, 5.0.1) Ondrej Gajdusek
CVE-2026-56097: Katello: SQL injection in Registry Proxy labels (fixed in 4.21.2, 5.0.1) Ondrej Gajdusek
CVE-2026-12545: Hammer CLI: editor command injection (fixed in 3.19.1, 5.0.1) Ondrej Gajdusek
CVE-2026-12544: Foreman: SSTI and unsafe deserialization in configuration (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-12542: Foreman: command injection in foreman-tail (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-12541: Foreman: command injection in foreman-rake database tasks (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-12540: Foreman: command injection in foreman-rake errors:fetch_log (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-12423: Foreman: provisioning token validation flaw (fixed in 3.19.2, 5.0.1) Ondrej Gajdusek
CVE-2026-12405: Foreman Remote Execution: command injection via effective_user (fixed in 16.6.6, 17.2.2, 18.0.1) Ondrej Gajdusek
CVE-2026-94114: Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser Gary D. Gregory
CVE-2026-105111: Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS Gary D. Gregory
CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records Jan Friedrich
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Jan Friedrich
CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter Jan Friedrich
CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded Jan Friedrich
CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records Jan Friedrich
CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content Jan Friedrich
CVE-2026-90466: Apache Impala: Path traversal executes JARs outside trusted paths Michael Smith
CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans Michael Smith
CVE-2026-97720: Apache Impala: Impala Executor Webserver Auth Bypass Michael Smith
FW: X.Org Security Advisory: multiple security issues in X.Org X server Peter Hutterer
Wednesday, 07 October
CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name Wilfred Spiegelenburg
CVE-2026-92393: Apache YuniKorn: Admission control bypass via workload UPDATE operation Wilfred Spiegelenburg
CVE-2026-97146: Apache YuniKorn: Admission control bypass via system label forgery Wilfred Spiegelenburg
CVE-2026-92414: Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens Julian Reschke
CVE-2026-92415: Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies Julian Reschke
CVE-2026-103371: Apache Geode: Management REST API: Insertion of Sensitive Information into Log File Jinwoo Hwang
[OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-pending) Goutham Pacha Ravi
Re: [OSSA-2026-043] OpenStack Zaqar: Zaqar WebSocket project substitution allows cross-project queue access (CVE-2026-107363) errata 1 Goutham Pacha Ravi
[OSSN-0109] Cross-project metric association bypass in Gnocchi Goutham Pacha Ravi
tor-0.4.9.14 released Sam James
CVE-2026-66082: Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow） Wenjun Ruan
CVE-2026-66084: Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint Wenjun Ruan
CVE-2026-66087: Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint Wenjun Ruan
CVE-2026-71183: Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords Wenjun Ruan
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials Wenjun Ruan
CVE-2026-71896: Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information Wenjun Ruan
Re: CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Demi Marie Obenour
Thursday, 08 October
OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) TheSecguy
Fwd: Go 1.27.2 and Go 1.26.9 are released Alan Coopersmith
Fwd: Vulnerabilities in golang.org/x/net Alan Coopersmith
[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147)) Jeremy Stanley
[OSSN-0110] Ironic can leak basic auth credentials to image server Jay Faulkner
Friday, 09 October
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets Xen . org security team
CVE-2026-71575: Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter Colm O hEigeartaigh
CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic Colm O hEigeartaigh
CVE-2026-78384: Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb) Colm O hEigeartaigh
CVE-2026-79650: Apache CXF: OIDC RP Open Redirect Colm O hEigeartaigh
CVE-2026-86463: Apache CXF: FIQL Query Parser Denial of Service Colm O hEigeartaigh
CVE-2026-97468: Apache CXF: Authentication bypass via weak cache keys for validated STS tokens Colm O hEigeartaigh
CVE-2026-97791: Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests Colm O hEigeartaigh
CVE-2026-100227: Apache CXF: XML Signature wrapping in JAX-RS XML Security Colm O hEigeartaigh
CVE-2026-107937: Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion. Colm O hEigeartaigh
CVE-2026-107938: Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification. Colm O hEigeartaigh
CVE-2026-108039: Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits Colm O hEigeartaigh
Re: OpenJPEG: heap-buffer-overflow write fixed on master since Feb 2026, still present in every release (2.5.3, 2.5.4) Stuart Henderson
CVE-2026-103412: Apache Camel Karavan: project file name path traversal when committing a project to Git Andrea Cosentino
CVE-2026-103413: Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml Andrea Cosentino
Multiple CVEs for illumos and distros: door server processes Dan McDonald
CVE for illumos and distros: VMM/BHYVE Dan McDonald
Unfixed vulnerabilities in Cyrus SASL Alan Coopersmith
mutt 2.4.3 released, fixes CVE-2026-107570 Alan Coopersmith
3 Vulnerabilities in GNU Aspell before 0.60.8.3 Alan Coopersmith
Saturday, 10 October
CVE-2026-103501: Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch Lee Rhodes
CVE-2026-103513: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
CVE-2026-103634: Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in Count-Min sketch deserialization allows memory corruption via a crafted sketch Lee Rhodes
CVE-2026-103635: Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch Lee Rhodes
CVE-2026-103636: Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch Lee Rhodes
CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument Robert Rothenberg
CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list Robert Rothenberg
Sunday, 11 October
Incomplete fix for Emacs CVE-2026-79992 Sean Whitton
Monday, 12 October
Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459) Nebojša Jaćović
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460) Nebojša Jaćović
CVE-2026-92116: Apache Allura: OAuth1 missing callback validation Dave Brondsema
CVE-2026-92119: Apache Allura: REST API Mass Assignment Dave Brondsema
CVE-2026-92120: Apache Allura: Oauth1 Replay Attack Dave Brondsema
[vim-security] Arbitrary Code Execution via Ruby Omni-Completion in Vim < 9.2.1177 Christian Brabandt
[vim-security] Command Execution via Rmd Syntax Highlighting in Vim < 9.2.1178 Christian Brabandt
Fwd: Announcing FreeType version 2.15.0 Alan Coopersmith
Tuesday, 13 October
CVE-2026-107460: Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding Shuxin Pan
Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update Xen . org security team
Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround Xen . org security team
Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems Xen . org security team
Xen Security Advisory 517 v2 (CVE-2026-79610) - grant-table: double version change race Xen . org security team
Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states Xen . org security team
Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush Xen . org security team
Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak Xen . org security team
Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() Xen . org security team
Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026 Thomas GERBET
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc) Rainer Gerhards
Hex 2.5.2 released with security fixes Alan Coopersmith
CVE-2026-74580: Linux vhost stale IOTLB cache leading to LPE and VM escape fourie
Wednesday, 14 October
[SECURITY ADVISORIES] curl 8.23.0 Daniel Stenberg
Re: Incomplete fix for Emacs CVE-2026-79992 Sam James
Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 Sam James
Godot 4.x: heap out-of-bounds read in OptimizedTranslation message lookup Tomasz Kaye
DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries Maxime Coquelin
Godot 4.x: heap out-of-bounds write via negative string length in binary resource loader Tomasz Kaye
Godot 4.x: heap out-of-bounds write in Radiance HDR image loader Tomasz Kaye
Upcoming Node.js security release 2026/10/21 Antoine du Hamel
Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595) Oleh Konko
NSD 4.15.3 security release Willem Toorop