Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list

• 2026/07/15 #5: CVE-2026-26032: Apache Ivy: PackagerResolver path traversal vulnerability (Stefan Bodewig <bodewig@...che.org>)
• 2026/07/15 #4: SELinux Userspace Utilities: Local Denial-of-Service Attack Vectors in seunshare in release 3.10 (Matthias Gerstner <mgerstner@...e.de>)
• 2026/07/15 #3: CVE-2026-57821: Apache Fineract: Office list: SQL Injection via Subquery in orderBy (Terence Monteiro <terencemo@...che.org>)
• 2026/07/15 #2: CVE-2026-56287: Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File D… (Terence Monteiro <terencemo@...che.org>)
• 2026/07/15 #1: CVE-2026-35152: Apache Fineract: SQL injection in runreports endpoint (Terence Monteiro <terencemo@...che.org>)
• 2026/07/14 #16: CVE-2026-15747: Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a… (Stig Palmquist <stig@...g.io>)
• 2026/07/14 #15: CVE-2026-15392: DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted loc… (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/14 #14: CVE-2026-60081: DBI::ProfileData versions before 1.651 for Perl do not limit the path index (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/14 #13: CVE-2026-60082: DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/14 #12: Xen Security Advisory 498 v2 (CVE-2026-42491) - XAPI: Missing TLS verification in some SDKs (Xen.org security team <security@....org>)
• 2026/07/14 #11: Re: new af_alg exploit in the wild? (Simon McVittie <smcv@...ian.org>)
• 2026/07/14 #10: CVE-2026-49488: Apache OpenMeetings: Arbitrary File Read (Maxim Solodovnik <solomax@...che.org>)
• 2026/07/14 #9: CVE-2026-15043: DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/14 #8: CVE-2026-59084: Apache Tomcat: EncryptInterceptor requirements not clearly documented (Mark Thomas <markt@...che.org>)
• 2026/07/14 #7: CVE-2026-59083: Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass (Mark Thomas <markt@...che.org>)
• 2026/07/14 #6: CVE-2026-62393: Apache Kylin: Improper authorization in job information retrieval (Li Yang <liyang@...che.org>)
• 2026/07/14 #5: CVE-2026-62392: Apache Kylin: OS Command Injection via Async Query API (Li Yang <liyang@...che.org>)
• 2026/07/14 #4: CVE-2026-62390: Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API (Li Yang <liyang@...che.org>)
• 2026/07/14 #3: CVE-2026-58319: Apache Doris: Improper Authentication in Frontend HTTP API (Mingyu Chen <morningman@...che.org>)
• 2026/07/14 #2: Re: new af_alg exploit in the wild? (Solar Designer <solar@...nwall.com>)
• 2026/07/14 #1: Re: new af_alg exploit in the wild? (Vincent Lefevre <vincent@...c17.net>)
• 2026/07/13 #9: new af_alg exploit in the wild? (Bernd Zeimetz <bernd@...d.de>)
• 2026/07/13 #8: 2 CVEs Crypt::OpenSSL::X509 versions before 2.1.3 (Timothy Legge <timlegge@...nsec.org>)
• 2026/07/13 #7: CVE-2026-57433: Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record (Stig Palmquist <stig@...g.io>)
• 2026/07/13 #6: CVE-2026-57432: Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read … (Stig Palmquist <stig@...g.io>)
• 2026/07/13 #5: CVE-2026-13221: Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more th… (Stig Palmquist <stig@...g.io>)
• 2026/07/13 #4: CVE-2026-59245: Apache Airflow FAB provider: FAB auth manager: a DAG named "DAGs" hijacks the global all-DAGs permission (acc… (Vincent Beck <vincbeck@...che.org>)
• 2026/07/13 #3: CVE-2026-58065: Apache Airflow Git provider: Git provider hook defaults to StrictHostKeyChecking=no, disabling SSH host-key … (Vincent Beck <vincbeck@...che.org>)
• 2026/07/13 #2: CVE-2026-49876: Apache Gravitino: Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network a… (Yu Qi <yuqi4733@...che.org>)
• 2026/07/13 #1: CVE-2026-41041: Apache Gravitino: URL path injection via unencoded user-supplied identifiers in MCP REST client f-string URL cons… (Jerry Shao <jshao@...che.org>)
• 2026/07/12 #2: Re: Skillable SCORM launch: userId parameter not validated against session token allows allocation bypass and cross-user DoS (Solar Designer <solar@...nwall.com>)
• 2026/07/12 #1: Skillable SCORM launch: userId parameter not validated against session token allows allocation bypass and cross-user DoS (gregdurys.security@...ton.me)
• 2026/07/11 #1: CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() (Piotr Karwasz <pkarwasz@...che.org>)
• 2026/07/10 #8: CVE-2026-40454: Apache IoTDB C++ client: Out-of-bounds reads in C++ client TsBlock deserializer crash client process on malforme… (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #7: CVE-2026-40452: Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authentica… (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #6: CVE-2026-40009: Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_aud… (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #5: CVE-2026-40008: Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #4: CVE-2026-40007: Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per… (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #3: CVE-2026-40006: Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #2: CVE-2026-40005: Apache IoTDB: Path Traversal in Pipe File Transfer Receiver (Haonan Hou <haonan@...che.org>)
• 2026/07/10 #1: CVE-2026-28564: Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials (Haonan Hou <haonan@...che.org>)
• 2026/07/09 #4: [CVE-2026-15308] Incremental HTMLParser allows CPU-exhaustion DoS via repeated unterminated markup declarations (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2026/07/09 #3: HTSlib <= 1.23.1 Multiple vulnerabilities in file reading code (Robert Davies <rmd@...ger.ac.uk>)
• 2026/07/09 #2: Re: Linux: GhostLock / CVE-2026-43499 / stack-UAF and LPE in kernels 2.6.39 till 7.1 (Vega Agent <vega@...usec.ai>)
• 2026/07/09 #1: Re: Linux: GhostLock / CVE-2026-43499 / stack-UAF and LPE in kernels 2.6.39 till 7.1 (Solar Designer <solar@...nwall.com>)
• 2026/07/08 #14: Re: CVE-2026-46242 ("Bad Epoll") local privilege escalation on Linux, including Android (Jan Engelhardt <ej@...i.de>)
• 2026/07/08 #13: CVE-2026-46242 ("Bad Epoll") local privilege escalation on Linux, including Android (Jan Schaumann <jschauma@...meister.org>)
• 2026/07/08 #12: Linux: GhostLock / CVE-2026-43499 / stack-UAF and LPE in kernels 2.6.39 till 7.1 ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
• 2026/07/08 #11: CVE-2026-57111: Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin (Junkai Xue <jxue@...che.org>)
• 2026/07/08 #10: Go 1.26.5 and Go 1.25.12 fix CVE-2026-39822 & CVE-2026-42505 (Alan Coopersmith <alan.coopersmith@...cle.com>)
• 2026/07/08 #9: CVE-2026-49147: App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences from filenames in several o… (Stig Palmquist <stig@...g.io>)
• 2026/07/08 #8: CVE-2026-49146: App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ack… (Stig Palmquist <stig@...g.io>)
• 2026/07/08 #7: CVE-2026-49145: App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc (Stig Palmquist <stig@...g.io>)
• 2026/07/08 #6: CVE-2026-14454: Imager versions before 1.033 for Perl treat unsigned EXIF IFD entry counts as signed (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/08 #5: CVE-2026-41042: Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, whic… (Jerry Shao <jshao@...che.org>)
• 2026/07/08 #4: [OSSA-2026-026] Ironic: Insufficient Access Controls regarding parent/child nodes (Jay Faulkner <jay@....cc>)
• 2026/07/08 #3: [OSSA-2026-025] Ironic: RBAC Bypass in IPMI Raw Command Execution (CVE-2026-54423) (Jay Faulkner <jay@....cc>)
• 2026/07/08 #2: FW: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Peter Hutterer <peter.hutterer@...-t.net>)
• 2026/07/08 #1: FW: X.Org Security Advisory: multiple security issues in libXfont2 (Peter Hutterer <peter.hutterer@...-t.net>)
• 2026/07/07 #18: CVE-2026-14895: String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/07 #17: CVE-2026-14740: DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL co… (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/07 #16: CVE-2026-14380: DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/07 #15: Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases, no… (Solar Designer <solar@...nwall.com>)
• 2026/07/07 #14: Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases, no ma… (Joe Stringer <joe@...valent.com>)
• 2026/07/07 #13: CVE-2026-7017: HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/07 #12: Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases, no… (Solar Designer <solar@...nwall.com>)
• 2026/07/07 #11: Re: [CVE request] Cilium ClusterNetworkPolicy matchExpressions Values silently dropped — 0-day in v1.20.0-pre releases… (Feroz Salam <feroz.salam@...valent.com>)
• 2026/07/07 #10: Django CVE-2026-48588, CVE-2026-53877, and CVE-2026-53878 (Jacob Walls <jwalls@...ngoproject.com>)
• 2026/07/07 #9: Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (Solar Designer <solar@...nwall.com>)
• 2026/07/07 #8: Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (yan xu <xuy0515@...il.com>)
• 2026/07/07 #7: Foreman: multiple vulnerabilities fixed in 3.18.2 and 3.19.1 (CVE-2026-5135, CVE-2026-5136, CVE-2026-5138, CVE-2026-5142) (Ondrej Gajdusek <ogajduse@...hat.com>)
• 2026/07/07 #6: CVE-2026-49487: Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs (Rahul Vats <rahulvats@...che.org>)
• 2026/07/07 #5: CVE-2026-49296: Apache Airflow: Per-DAG read bypass discloses co-located DAGs' source via GET /api/v2/dagSources/{dag_id} (Rahul Vats <rahulvats@...che.org>)
• 2026/07/07 #4: CVE-2026-48892: Apache Airflow: Config API leaks per-key secrets backend kwargs - masker bypass on synthetic options (Rahul Vats <rahulvats@...che.org>)
• 2026/07/07 #3: CVE-2026-48891: Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.sou… (Rahul Vats <rahulvats@...che.org>)
• 2026/07/07 #2: CVE-2026-48828: Apache Airflow: Bulk JSON Variables bypass should_hide_value_for_key - redact() called without the key (Rahul Vats <rahulvats@...che.org>)
• 2026/07/07 #1: CVE-2026-33264: Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize… (Rahul Vats <rahulvats@...che.org>)
• 2026/07/06 #17: CVE-2026-49042: Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters (Federico Mariani <fmariani@...che.org>)
• 2026/07/06 #16: CVE-2026-46588: Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operatio… (Federico Mariani <fmariani@...che.org>)
• 2026/07/06 #15: CVE-2026-46587: Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operat… (Federico Mariani <fmariani@...che.org>)
• 2026/07/06 #14: CVE-2026-43867: Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metad… (Andrea Cosentino <acosentino@...che.org…)
• 2026/07/06 #13: CVE-2026-43866: Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder (Andrea Cosentino <acosentino@...che.org>)
• 2026/07/06 #12: CVE-2026-24014: Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write (Haonan Hou <haonan@...che.org>)
• 2026/07/06 #11: CVE-2026-24013: Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC (Haonan Hou <haonan@...che.org>)
• 2026/07/06 #10: CVE-2026-24012: Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query (Haonan Hou <haonan@...che.org>)
• 2026/07/06 #9: CVE-2026-43825: Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel (Richard Zowalla <rzo1@...che.org>)
• 2026/07/06 #8: c-ares 1.34.7 release: CVE-2026-33630, GHSA-pjmc-gx33-gc76, GHSA-jv8r-gqr9-68wj (Brad House <brad@...d-house.com>)
• 2026/07/06 #7: Januscape: Guest-to-Host Escape in KVM/x86 (CVE-2026-53359) (Hyunwoo Kim <imv4bel@...il.com>)
• 2026/07/06 #6: Security Considerations for Statsd Clients (Robert Rothenberg <rrwo@...nsec.org>)
• 2026/07/06 #5: Announce: OpenSSH 10.4 released (Damien Miller <djm@....openbsd.org>)
• 2026/07/06 #4: CVE-2026-13708: Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 marker… (Stig Palmquist <stig@...g.io>)
• 2026/07/06 #3: CVE-2026-13705: Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via … (Stig Palmquist <stig@...g.io>)
• 2026/07/06 #2: CVE-2026-14803: Mojo::JSON versions before 9.47 for Perl allow memory exhaustion via unbounded recursion in the pure-Perl decoder (Stig Palmquist <stig@...g.io>)
• 2026/07/06 #1: Re: Wasm OCI Image Fetcher Bearer Realm SSRF Bypass (Eli Schwartz <eschwartz@...too.org>)
• 2026/07/05 #30: CVE-2026-56140: Apache Camel: Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy t… (Andrea Cosentino <acosentino@...che.org…)
• 2026/07/05 #29: CVE-2026-56139: Apache Camel: Camel-Undertow: The muteException consumer option defaulted to false, so a processing err… (Andrea Cosentino <acosentino@...che.org…)
• 2026/07/05 #28: CVE-2026-55994: Apache Camel: Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into … (Andrea Cosentino <acosentino@...che.org…)
• 2026/07/05 #27: CVE-2026-55993: Apache Camel: Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query… (Andrea Cosentino <acosentino@...che.org…)
• 2026/07/05 #26: CVE-2026-53913: Apache Camel: Camel-Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its … (Andrea Cosentino <acosentino@...che.org…)
• 2026/07/05 #25: CVE-2026-49365: Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing e… (Andrea Cosentino <acosentino@...che.org…)

33538 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.