oss-security mailing list - 2026/03

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/03

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 5	³ 8	⁴ 1	⁵ 7	⁶ 4	⁷ 5	⁸ 11
⁹ 8	¹⁰ 1	¹¹ 6	¹² 10	¹³ 4	¹⁴ 4	¹⁵ 1
¹⁶ 6	¹⁷ 11	¹⁸ 12	¹⁹ 10	²⁰ 6	²¹ 7	²² 3
²³ 2	²⁴ 6	²⁵ 8	²⁶ 7	²⁷ 5	²⁸ 6	²⁹ 2
³⁰ 9	³¹

Messages by day:

March 2 (5 messages)

Re: OSEC-2026-01 in the OCaml runtime: Buffer Over-Read in OCaml Marshal Deserialization (Demi Marie Obenour <demiobenour@...il.com>)
Re: OSEC-2026-01 in the OCaml runtime: Buffer Over-Read in OCaml Marshal Deserialization (Florian Weimer <fweimer@...hat.com>)
Exiv2 version 0.28.8 released with fixes for 3 low-severity CVEs (Kevin Backhouse <kevin.backhouse@...il.com>)
CVE-2025-59060: Apache Ranger: Hostname verification bypass in NiFiRegistryClient and NifiClient (Velmurugan Periasamy <vel@...che.org>)
CVE-2025-59059: Apache Ranger: Remote Code Execution Vulnerability in NashornScriptEngineCreator (Velmurugan Periasamy <vel@...che.org>)

March 3 (8 messages)

Fwd: [siren] [Security Advisory] Active Exploitation of Weak GitHub Actions Configurations (Solar Designer <solar@...nwall.com>)
Re: OSEC-2026-01 in the OCaml runtime: Buffer Over-Read in OCaml Marshal Deserialization (Demi Marie Obenour <demiobenour@...il.com>)
Django CVE-2026-25673 and CVE-2026-25674 (Natalia Bidart <nataliabidart@...ngoproject.com>)
CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation (Justin Bertram <jbertram@...che.org>)
CVE-2025-66168: Apache ActiveMQ, Apache ActiveMQ All Module, Apache ActiveMQ MQTT Module: MQTT control packet remaining… ("Christopher L. Shannon" <cshannon@...c…)
[OSSA-2026-003] OpenStack Vitrage: Remote code execution through Vitrage query parser (CVE-2026-28370) (Jeremy Stanley <fungi@...goth.org>)
Issue with AWS-LC: an open-source, general-purpose cryptographic library (CVE-2026-3336, CVE-2026-3337, CVE-2026-3338) (Jan Schaumann <jschauma@...meister.org>)
Announcing FreeType 2.14.2, fixes CVE-2026-23865 (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 4 (1 message)

Re: CVE-2026-27446: Apache Artemis, Apache ActiveMQ Artemis: Auth bypass for Core downstream federation (Yogesh Mittal <ymittal@...hat.com>)

March 5 (7 messages)

CVE-2024-57854: Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator (Robert Rothenberg <rrwo@...n.org>)
CVE-2025-40926: Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely (Robert Rothenberg <rrwo@...n.org>)
CVE-2025-40931: Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id (Robert Rothenberg <rrwo@...n.org>)
CVE-2026-3257: UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library (Robert Rothenberg <rrwo@...n.org>)
CVE-2026-3381: Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib (Robert Rothenberg <rrwo@...n.org>)
Fwd: [CVE-2026-2297] SourcelessFileLoader does not use io.open_code() (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-13350 for Ubuntu Linux kernel (Seth Arnold <seth.arnold@...onical.com>)

March 6 (4 messages)

Go 1.26.1 and Go 1.25.8 are released with 5 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CVE-2026-28372: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
Re: CVE-2026-28372: Telnetd Vulnerability Report (Guillem Jover <guillem@...ian.org>)
CVE-2025-69534 in Python-Markdown (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 7 (5 messages)

Re: CVE-2026-28372: Telnetd Vulnerability Report (Salvatore Bonaccorso <carnil@...ian.org>)
Re: CVE-2026-28372: Telnetd Vulnerability Report (Guillem Jover <guillem@...ian.org>)
Re: Telnetd Vulnerability Report (Justin Swartz <justin.swartz@...ingedge.co.za>)
CVE-2026-24281: Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager (Andor Molnar <andor@...che.org>)
CVE-2026-24308: Apache ZooKeeper: Sensitive information disclosure in client configuration handling (Andor Molnar <andor@...che.org>)

March 8 (11 messages)

CVE-2026-30909: Crypt::NaCl::Sodium versions through 2.002 for Perl has potential integer overflows (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-30910: Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows (Timothy Legge <timlegge@...nsec.org>)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
Re: Telnetd Vulnerability Report (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Re: Telnetd Vulnerability Report (Pat Gunn <pgunn01@...il.com>)
Re: Telnetd Vulnerability Report (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)
AWStats awdownloadcsv.pl command injection and path traversal vulnerabilities ("christopher.downs" <christopher.downs@...ersecurity.com>)
Re: AWStats awdownloadcsv.pl command injection and path traversal vulnerabilities (Hanno Böck <hanno@...eck.de>)
Re: Telnetd Vulnerability Report (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Telnetd Vulnerability Report (Solar Designer <solar@...nwall.com>)

March 9 (8 messages)

CVE-2025-69219: Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE v… (Jarek Potiuk <potiuk@...che.org>)
CVE-2025-55017: Apache IoTDB: Path Traversal Vulnerability (Haonan Hou <haonan@...che.org>)
CVE-2025-64152: Apache IoTDB: Path Traversal Vulnerability (Haonan Hou <haonan@...che.org>)
CVE-2026-24713: Apache IoTDB: JEXL Expression Injection Vulnerability (Haonan Hou <haonan@...che.org>)
CVE-2026-24015: Apache IoTDB: Insecure Default Configuration Vulnerability (Haonan Hou <haonan@...che.org>)
CVE-2026-25604: Apache Airflow AWS Auth Manager - Host Header Injection Leading to SAML Authentication Bypass (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-28431+more: Misskey/Sharkey "extremely severe" vulnerabilities (Valtteri Vuorikoski <vuori@...com.org>)
[kubernetes] CVE-2026-3288: ingress-nginx rewrite-target nginx configuration injection (Tabitha Sable <tabitha.c.sable@...il.com>)

March 10 (1 message)

CVE-2026-23907: Apache PDFBox Examples: Path Traversal in PDFBox ExtractEmbeddedFiles Example Code (Tilman Hausherr <tilman@...che.org>)

March 11 (6 messages)

[ADVISORY] curl: CVE-2026-1965: bad reuse of HTTP Negotiate connection (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-3783: token leak with redirect and netrc (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-3784: wrong proxy connection reuse with credentials (Daniel Stenberg <daniel@...x.se>)
[ADVISORY] curl: CVE-2026-3805: use after free in SMB connection reuse (Daniel Stenberg <daniel@...x.se>)
The GNU C Library security advisory update for 2026-03-11 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
[vim-security] NFA regex engine NULL pointer dereference affects Vim < 9.2.0137 (Christian Brabandt <cb@...bit.org>)

March 12 (10 messages)

CVE-2025-60012: Apache Livy: Restrict file access (György Gál <ggal@...che.org>)
CVE-2025-66249: Apache Livy: Unauthorized directory access (György Gál <ggal@...che.org>)
OpenSSH GSSAPI keyex patch issue (Marc Deslauriers <marc.deslauriers@...onical.com>)
Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd (LINEMODE SLC) (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd (LINEMODE SLC) (Solar Designer <solar@...nwall.com>)
Multiple vulnerabilities in AppArmor (Qualys Security Advisory <qsa@...lys.com>)
Re: Multiple vulnerabilities in AppArmor (Qualys Security Advisory <qsa@...lys.com>)
Re: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd (LINEMODE SLC) (Collin Funk <collin.funk1@...il.com>)
Re: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd (LINEMODE SLC) (Paul Eggert <eggert@...ucla.edu>)
Re: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd (LINEMODE SLC) (Solar Designer <solar@...nwall.com>)

March 13 (4 messages)

Some telnet clients leak environment variables (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Some telnet clients leak environment variables (Stuart Henderson <stu@...cehopper.org>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.foundation>)
CVE-2025-54920: Apache Spark: Spark History Server Code Execution Vulnerability (Holden Karau <holden@...che.org>)

March 14 (4 messages)

Re: Remote Pre-Auth Buffer Overflow in GNU Inetutils telnetd (LINEMODE SLC) (Collin Funk <collin.funk1@...il.com>)
Re: Some telnet clients leak environment variables (Solar Designer <solar@...nwall.com>)
Re: OpenSSH GSSAPI keyex patch issue (Solar Designer <solar@...nwall.com>)
Re: OpenSSH GSSAPI keyex patch issue (Dmitry Belyavskiy <dbelyavs@...hat.com>)

March 15 (1 message)

Foswiki 2.1.11 is released, fixes CVE-2026-2861 (Michael Daum <foswiki@...haeldaumconsulting.com>)

March 16 (6 messages)

Re: Foswiki 2.1.11 is released, fixes CVE-2026-2861 (Solar Designer <solar@...nwall.com>)
10+ CVEs in GStreamer (Solar Designer <solar@...nwall.com>)
Re: Foswiki 2.1.11 is released, fixes CVE-2026-2861 (Michael Daum <foswiki@...haeldaumconsulting.com>)
[CVE-2026-4224] CPython Stack overflow parsing XML with deeply nested DTD content models (Alan Coopersmith <alan.coopersmith@...cle.com>)
[CVE-2026-3644] CPython Incomplete control character validation in http.cookies (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-4177: YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-s… (Timothy Legge <timlegge@...nsec.org>)

March 17 (11 messages)

[kubernetes] CVE-2026-3864: CSI Driver for NFS path traversal via subDir may delete unintended directories on the NFS serve… (Rita Zhang <rita.z.zhang@...il.com>)
CVE-2026-30911: Apache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization (Rahul Vats <rahulvats@...che.org>)
CVE-2026-28779: Apache Airflow: Path of session token in cookie does not consider base_url - session hijacking via co-hosted … (Rahul Vats <rahulvats@...che.org>)
CVE-2026-26929: Apache Airflow: Wildcard DagVersion Listing Bypasses Per‑DAG RBAC and Leaks Metadata (Rahul Vats <rahulvats@...che.org>)
CVE-2026-28563: Apache Airflow: DAG authorization bypass (Rahul Vats <rahulvats@...che.org>)
Xen Security Advisory 480 v3 (CVE-2026-23554) - Use after free of paging structures in EPT (Xen.org security team <security@....org>)
Xen Security Advisory 481 v2 (CVE-2026-23555) - Xenstored DoS by unprivileged domain (Xen.org security team <security@....org>)
snap-confine + systemd-tmpfiles = root (CVE-2026-3888) (Qualys Security Advisory <qsa@...lys.com>)
Re: snap-confine + systemd-tmpfiles = root (CVE-2026-3888) (Michal Zalewski <lcamtuf@...edump.cx>)
libexpat 2.7.5 fixes three vulnerabilities (2x null deref, 1x infinite loop) (Sebastian Pipping <sebastian@...ping.org>)
Re: libexpat 2.7.5 fixes three vulnerabilities (2x null deref, 1x infinite loop) (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 18 (12 messages)

Re: snap-confine + systemd-tmpfiles = root (CVE-2026-3888) (Michael Orlitzky <michael@...itzky.com>)
Re: OpenSSH GSSAPI keyex patch issue (Dmitry Belyavskiy <dbelyavs@...hat.com>)
[SBA-ADV-20251205-01] LibreChat 0.8.1-rc2 RAG API Authentication Bypass (SBA Research Security Advisory <advisory@...-research.org>)
Re: OpenSSH GSSAPI keyex patch issue (Solar Designer <solar@...nwall.com>)
Re: OpenSSH GSSAPI keyex patch issue (Dmitry Belyavskiy <dbelyavs@...hat.com>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
Re: OpenSSH GSSAPI keyex patch issue (Jeffrey Walton <noloader@...il.com>)
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0001 (Adrian Perez de Castro <aperez@...lia.com>)
CVE-2026-31970: HTSlib <= 1.23 heap buffer overflow in the BGZF index file reader (Robert Davies <rmd@...ger.ac.uk>)
HTSlib <= 1.23 Multiple vulnerabilities in the CRAM file reader (Robert Davies <rmd@...ger.ac.uk>)
CVE-2026-31972: samtools <= 1.21 Use-after-free in mpileup leading to an invalid read (Robert Davies <rmd@...ger.ac.uk>)
CVE-2026-31973: samtools <= 1.23 NULL pointer dereference in cram-size (Robert Davies <rmd@...ger.ac.uk>)

March 19 (10 messages)

CVE-2006-10002: XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corru… (Timothy Legge <timlegge@...nsec.org>)
CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack (Timothy Legge <timlegge@...nsec.org>)
[OSSA-2026-004] Glance: Server-Side Request Forgery (SSRF) vulnerabilities in OpenStack Glance image import functionali… (Brian Rosmaita <rosmaita.fossdev@...il.…)
Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
Re: Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
Re: Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
Re: Off-by-one heap buffer overflow in libuv (Stuart Henderson <stu@...cehopper.org>)
Re: Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
[kubernetes] CVE-2026-4342: ingress-nginx comment-based nginx configuration injection (Tabitha Sable <tabitha.c.sable@...il.com>)
[vim-security]: Command injection via newline in glob() affects Vim < 9.2.0202 (Christian Brabandt <cb@...bit.org>)

March 20 (6 messages)

Fwd: [CPython][CVE-2026-4519] webbrowser.open() API allows leading dashes (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-32642: Apache Artemis, Apache ActiveMQ Artemis: Temporary address auto-created for OpenWire consumer without crea… (Justin Bertram <jbertram@...che.org>)
nghttp2 Denial of service: Assertion failure due to the missing state validation (Alan Coopersmith <alan.coopersmith@...cle.com>)
[CVE-2026-30922] Denial of Service in pyasn1 via Unbounded Recursion (Alan Coopersmith <alan.coopersmith@...cle.com>)
pyOpenSSL 26.0.0 released with two CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Buffer overflow in /bin/su from UNIX v4 (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 21 (7 messages)

Trivy github actions repo compromised, infostealer added (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref) (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
Re: pyOpenSSL 26.0.0 released with two CVE fixes (Alex Gaynor <alex.gaynor@...il.com>)
Re: Buffer overflow in /bin/su from UNIX v4 (kf503bla@...k.com)
Re: Buffer overflow in /bin/su from UNIX v4 (Solar Designer <solar@...nwall.com>)
Re: Buffer overflow in /bin/su from UNIX v4 (Justin Swartz <justin.swartz@...ingedge.co.za>)
Re: Buffer overflow in /bin/su from UNIX v4 (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 22 (3 messages)

Re: Buffer overflow in /bin/su from UNIX v4 (Steffen Nurpmeso <steffen@...oden.eu>)
Re: Buffer overflow in /bin/su from UNIX v4 (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: CVE-2006-10002: XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a hea… (Salvatore Bonaccorso <carnil@...ian.org…)

March 23 (2 messages)

Re: Trivy github actions repo compromised, infostealer added (Jeremy Utiera <jeremyutiera@...il.com>)
The GNU C Library security advisories update for 2026-03-23 (Carlos O'Donell <carlos@...hat.com>)

March 24 (6 messages)

Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdown (Xen.org security team <security@....org>)
Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdown (Greg KH <greg@...ah.com>)
Xen Security Advisory 482 v3 (CVE-2026-31788) - Linux privcmd driver can circumvent kernel lockdown (Xen.org security team <security@....org>)
Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdown (Greg KH <greg@...ah.com>)
Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdown (Andrew Cooper <andrew.cooper3@...rix.com>)
litellm pypi packages compromised, infostealer added (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 25 (8 messages)

NodeJS Security Releases fixes High, 5 Medium, 2 Low severity issues (Jan Schaumann <jschauma@...meister.org>)
[ADVISORY] SQUID-2026:1 Denial of Service in ICP Request handling (CVE-2026-33526) (Amos Jeffries <squid3@...enet.co.nz>)
[ADVISORY] SQUID-2026:2 Denial of Service in ICP Request handling (CVE-2026-32748) (Amos Jeffries <squid3@...enet.co.nz>)
[ADVISORY] SQUID-2026:3 Out of Bounds Read in ICP message handling (CVE-2026-33515) (Amos Jeffries <squid3@...enet.co.nz>)
backdoor in litellm version 1.82.7 (Jan Schaumann <jschauma@...meister.org>)
ISC has disclosed one vulnerability in Kea (CVE-2026-3608) (Peter Davies <peterd@....org>)
ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-1519, CVE-2026-3104, CVE-2026-3119, CVE-2026-3591) (Nicki Křížek <nicki@....org>)
Re: CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref) (Abhinav Agarwal <abhinavagarwal1996@...il.com>)

March 26 (7 messages)

libpng 1.6.56: Two high-severity vulnerabilities fixed: CVE-2026-33416, CVE-2026-33636 (Cosmin Truta <ctruta@...il.com>)
CVE-2014-125112: Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution (Timothy Legge <timlegge@...nsec.org>)
7 CVEs fixed in nginx (Solar Designer <solar@...nwall.com>)
Re: Xen Security Advisory 482 v2 - Linux privcmd driver can circumvent kernel lockdown (Juergen Gross <jgross@...e.com>)
Re: Multiple vulnerabilities in AppArmor (Qualys Security Advisory <qsa@...lys.com>)
CVE-2026-4851: remote-to-local code execution in GRID::Machine (piedcrow@...eup.net)
TigerVNC 1.16.2 security release (Alan Coopersmith <alan.coopersmith@...cle.com>)

March 27 (5 messages)

Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
Dovecot Security Advisory OXDC-2026-0001 (Aki Tuomi <aki.tuomi@...ecot.fi>)
CVE-2026-1961: Foreman: Remote Code Execution via command injection in WebSocket proxy (Ondrej Gajdusek <ogajduse@...hat.com>)
Re: Multiple vulnerabilities in AppArmor (Qualys Security Advisory <qsa@...lys.com>)
Re: Re: Multiple vulnerabilities in AppArmor (kf503bla@...k.com)

March 28 (6 messages)

WebKitGTK and WPE WebKit Security Advisory WSA-2026-0002 (Adrian Perez de Castro <aperez@...lia.com>)
Re: [ADVISORY] SQUID-2026:1 Denial of Service in ICP Request handling (CVE-2026-33526) (Solar Designer <solar@...nwall.com>)
Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
CVE-2025-15604: Amon2 versions before 6.17 for Perl use an insecure random_string implementation for security functions (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-3256: HTTP::Session versions through 0.53 for Perl defaults to using insecurely generated session ids (Robert Rothenberg <rrwo@...nsec.org>)
Re: Multiple vulnerabilities in AppArmor (John Johansen <john.johansen@...onical.com>)

March 29 (2 messages)

Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
[CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)

March 30 (9 messages)

CVE-2026-4176: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vul… (Stig Palmquist <stig@...g.io>)
Re: CVE-2026-4176: Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 co… (Jacob Bachmeyer <jcb62281@...il.com>)
[vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
Re: [vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Demi Marie Obenour <demiobenour@...il.com>)
KVM shadow EPT stale rmap use-after-free (Sandipan Roy <saroy@...hat.com>)
Re: KVM shadow EPT stale rmap use-after-free (Demi Marie Obenour <demiobenour@...il.com>)
The GNU C Library security advisory update for 2026-03-30 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
pyca/cryptography: CVE-2026-34073: X.509: bypass of name constraints on wildcard SANs with matching peer names (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-32794: Apache Airflow Provider for Databricks: TLS Certificate Verification Disabled in Databricks Provider K8s T… (Jens Scheffler <jscheffl@...che.org>)

175 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.