oss-sec: by date
RSS Feed
About List
All Lists
Previous period
38 messages
starting Oct 01 26 and
ending Oct 02 26
Date index |
Thread index |
Author index
Thursday, 01 October
CVE-2026-88789: Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening James Netherton
CVE-2026-78242: Apache APISIX: data-mask may fail to redact request headers in logger output Abhishek Choudhary
CVE-2026-82806: Apache APISIX: cross-request permission pollution via static permission list mutation Abhishek Choudhary
CVE-2026-94212: Apache APISIX: unauthenticated impersonation issue in saml-auth Abhishek Choudhary
CVE-2026-94220: Apache APISIX: session fixation issue in feishu-auth and dingtalk-auth plugin Abhishek Choudhary
CVE-2026-94250: Apache APISIX: Batch response aggregation can exhaust worker memory Abhishek Choudhary
CVE-2026-94269: Apache APISIX: Servlet-style normalization creates a route/upstream authorization mismatch Abhishek Choudhary
CVE-2026-94276: Apache APISIX: Openid-connect introspection validation issue Abhishek Choudhary
CVE-2026-102504: Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol Stig Palmquist
CVE-2026-102505: Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp Stig Palmquist
CVE-2026-42356: Apache HTTP Server: limited RCE for some internal redirects to non-CGI files in CGI directories Eric Covener
CVE-2026-42528: Apache HTTP Server: mod_dav shared lock overflow Eric Covener
CVE-2026-46729: Apache HTTP Server: mod_heartmonitor denial of service Eric Covener
CVE-2026-47360: Apache HTTP Server: mod_session: Session cookie not removed during internal redirect Eric Covener
CVE-2026-48005: Apache HTTP Server: mod_auth_digest reauthentication attack Eric Covener
CVE-2026-56153: Apache HTTP Server: mod_charset_lite: Heap overflow in finish_partial_char Eric Covener
CVE-2026-56154: Apache HTTP Server: mod_rewrite use-after-free via %{LA-U:HTTP:...} Eric Covener
CVE-2026-56449: Apache HTTP Server: mod_proxy_html: crash in dump_content Eric Covener
CVE-2026-57941: Apache HTTP Server: mod_http2 use-after-free / wild write via shared session->bbtmp re-entrancy Eric Covener
CVE-2026-58415: Apache HTTP Server: mod_dav_fs property database read access Eric Covener
CVE-2026-59685: Apache HTTP Server: Out-of-Bounds Write in ap_directory_walk() Canonical-Name Rewrite on CASE_BLIND_FILESYSTEM Eric Covener
CVE-2026-59797: Apache HTTP Server: mod_ssl SSLRequire allows .htaccess ap_expr file-function Eric Covener
CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling Eric Covener
CVE-2026-63292: Apache HTTP Server: mod_vhost_alias stack overflow Eric Covener
CVE-2026-63686: Apache HTTP Server: mod_xml2enc crash on charset conversion failure Eric Covener
CVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling Eric Covener
CVE-2026-73636: Apache HTTP Server: mod_auth_digest one-time-nonce replay attack Eric Covener
CVE-2026-73637: Apache HTTP Server: mod_auth_digest DoS attack Eric Covener
CVE-2026-79768: Apache HTTP Server: mod_userdir information disclosure Eric Covener
CVE-2026-93546: Apache HTTP Server: mod_dav_fs namespace overflow Eric Covener
Friday, 02 October
CVE-2026-102795: Apache Traffic Server: SNI to Host header matching policy is not properly enforced (supersedes CVE-2026-41920) Masakazu Kitajo
CVE-2026-59265: Apache OpenOffice: Opening a malicious document can lead to system takeover Dave Fisher
CVE-2026-102731: Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode Emmanuel Lécharny
CVE-2026-103552: Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder Emmanuel Lécharny
CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements Emmanuel Lécharny
CVE-2026-103878: Apache Directory LDAP API: Injection of plaintext responses during StartTLS Emmanuel Lécharny
CVE-2026-103880: Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords Emmanuel Lécharny
CVE-2026-103885: Apache Directory LDAP API: Denial of service via crafted telephone number values Emmanuel Lécharny