oss-security mailing list - 2026/06

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2026/06

Mon	Tue	Wed	Thu	Fri	Sat	Sun
¹ 13	² 13	³ 18	⁴ 17	⁵	⁶ 7	⁷ 1
⁸ 17	⁹ 15	¹⁰ 22	¹¹ 12	¹² 5	¹³ 22	¹⁴ 5
¹⁵ 11	¹⁶ 13	¹⁷ 10	¹⁸ 7	¹⁹ 16	²⁰ 7	²¹ 2
²² 7	²³ 11	²⁴ 9	²⁵ 11	²⁶ 8	²⁷ 8	²⁸ 2
²⁹ 26	³⁰ 4

Messages by day:

June 1 (13 messages)

CVE-2026-8796: Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input (Paul Johnson <paul@...j.net>)
CVE-2026-35563: Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches… (Emmanuel Lécharny <elecharny@...che.or…)
CVE-2026-45192: Apache Airflow: Incomplete Redaction of Sensitive Fields in Connection Extra API Response (Rahul Vats <rahulvats@...che.org>)
CVE-2026-49328: Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF (Shuxin Pan <psxjoy@...che.org>)
[CVE-2026-8643] pip can extract console_scripts and gui_scripts outside installation directory (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: CIFSwitch: Linux kernel/cifs-utils local root via forged cifs.spnego upcall (manizada <manizada@...me>)
CVE-2026-46718: Apache Calcite: A user-controled model can load arbitrary classes, leading to code execution (Julian Hyde <jhyde@...che.org>)
CVE-2025-60481: NULL Pointer Dereference in GPAC/MP4Box via gf_odf_ac4_cfg_dsi_v1 on crafted AC-4 stream ("Alexander A. Shvedov" <shvedov@....com>)
CVE-2025-60483: NULL Pointer Dereference in GPAC/MP4Box via gf_ac4_pres_b_4_back_channels_present on crafted AC-4 strea… ("Alexander A. Shvedov" <shvedov@....com…)
CVE-2025-55664: Heap-based Buffer Overflow in GPAC/MP4Box via m2tsdmx_send_packet on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....com>)
CVE-2025-60485: NULL Pointer Dereference in GPAC/MP4Box via gf_isom_apple_set_tag_ex on crafted MP4 with corrupted esds… ("Alexander A. Shvedov" <shvedov@....com…)
CVE-2025-60486: Use-After-Free in GPAC/MP4Box via dasher_process on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....com>)
CVE-2025-60495: NULL Pointer Dereference in GPAC/MP4Box via gf_media_get_color_info on crafted MP4 with inconsistent sa… ("Alexander A. Shvedov" <shvedov@....com…)

June 2 (13 messages)

FW: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Peter Hutterer <peter.hutterer@...-t.net>)
BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Bakabaka_9 <qilunuobakabaka9@...il.com>)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Stuart Henderson <stu@...cehopper.org>)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Dan Yefihmov <dan@...htwave.net.ru>)
CVE-2026-41115: Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API (Luke Chen <showuon@...che.org>)
[OSSA-2026-014] OpenStack Swift: Errata 1 - Proxy-server denial of service via truncated s3api chunked upload, (CVE-202… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSA-2026-016] OpenStack Neutron: Errata 1 - Tagging policy bypass allows project readers to mutate tags (CVE-2026-492… (Goutham Pacha Ravi <gouthampravi@...il.…)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Bakabaka_9 <qilunuobakabaka9@...il.com>)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Stuart Henderson <stu@...cehopper.org>)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Dan Yefihmov <dan@...htwave.net.ru>)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Stuart Henderson <stu@...cehopper.org>)
Linux kernel TLS ULP use-after-free in tls_sk_proto_close() (Oleg Sevostyanov <savant05@...il.com>)
Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending (Dan Yefihmov <dan@...htwave.net.ru>)

June 3 (18 messages)

Fwd: FreeIPMI 1.6.18 Released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
Fwd: Go 1.26.4 and Go 1.25.11 are released (Alan Coopersmith <alan.coopersmith@...cle.com>)
HTTP/2 Bomb affects Apache httpd, nginx, envoy, & pingora (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-9334: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_array… (Paul Johnson <paul@...j.net>)
CVE-2026-9516: Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode f… (Paul Johnson <paul@...j.net>)
Re: Linux kernel TLS ULP use-after-free in tls_sk_proto_close() (Jacob Bachmeyer <jcb62281@...il.com>)
Re: Fwd: FreeIPMI 1.6.18 Released with security fixes (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Fwd: FreeIPMI 1.6.18 Released with security fixes (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Linux kernel TLS ULP use-after-free in tls_sk_proto_close() (Oleg Sevostyanov <savant05@...il.com>)
Django CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193, and CVE-2026-48587 (Natalia Bidart <nataliabidart@...ngoproject.com>)
[OSSA-2026-017] Ironic: Script injection during node boot via linux command line override (CVE-2026-46447) (Jay Faulkner <jay@....cc>)
[OSSA-2026-018] Ironic: File overwrite on Ironic conductor via path traversal in ISO handling (CVE-2026-48681) (Jay Faulkner <jay@....cc>)
[OSSA-2026-019] Ironic: File Extraction from conductor via pxe_template (CVE-2026-44917) (Jay Faulkner <jay@....cc>)
[OSSA-2026-020] OpenStack Mistral: Mistral policy enforcement bypass allows unauthorized public resource creation and a… (Goutham Pacha Ravi <gouthampravi@...il.…)
[CVE-2026-3276] Potential DoS via quadratic complexity in unicodedata.normalize() (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: Linux kernel TLS ULP use-after-free in tls_sk_proto_close() ("Emily Shepherd" <emily@...coat.dev>)
CVE-2026-48842+more: Roundcube numerous vulnerabilities prior to 1.6.16/1.7.1 (Valtteri Vuorikoski <vuori@...com.org>)
5 CVEs in Redis (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 4 (17 messages)

CVE-2026-8722: Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-8829: HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (Paul Johnson <paul@...j.net>)
Re: Linux kernel TLS ULP use-after-free in tls_sk_proto_close() (Jacob Bachmeyer <jcb62281@...il.com>)
CVE-2026-50076: Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass (Chaokun Yang <chaokunyang@...che.org>)
libinput: libinput-device-group unescaped phys output can inject udev properties (Peter Hutterer <peter.hutterer@...-t.net>)
[OSSA-2026-021] OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device owners… (Goutham Pacha Ravi <gouthampravi@...il.…)
CVE-2026-46739: Net::Statsd versions before 0.13 for Perl allow metric injections (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-46741: Etsy::StatsD versions through 1.002002 for Perl allow metric injections (Robert Rothenberg <rrwo@...nsec.org>)
[CVE-2026-7774] Cpython: tarfile.data_filter path traversal bypass allows writing outside the extraction directory (Alan Coopersmith <alan.coopersmith@...cle.c…)
CVE-2026-49940: Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-49941: Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-49942: Net::CIDR::Set versions through 0.20 for Perl did not validate network masks (Robert Rothenberg <rrwo@...nsec.org>)
Re: [OSSA-2026-021] OpenStack Neutron: Neutron port RBAC policy bypass allows project managers to set trusted device ow… (Goutham Pacha Ravi <gouthampravi@...il.…)
[vim-security] Arbitrary Code Execution via Python Omni-Completion in Vim < 9.2.597 (Christian Brabandt <cb@...bit.org>)
Re: HTTP/2 Bomb affects Apache httpd, nginx, envoy, & pingora (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: libinput: libinput-device-group unescaped phys output can inject udev properties (Peter Hutterer <peter.hutterer@...-t.net>)
Re: FW: X.Org Security Advisory: multiple security issues X.Org X server and Xwayland (Peter Hutterer <peter.hutterer@...-t.net>)

June 6 (7 messages)

Project Zero discloses 4 bugs in FreeType (Alan Coopersmith <alan.coopersmith@...cle.com>)
[OSSN-0099] Denial of Service in OpenStack Ironic under reduced process stack size (CVE-2026-50589) (Jay Faulkner <jay@....cc>)
Re: libinput: libinput-device-group unescaped phys output can inject udev properties (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2026-10879: DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 bi… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-9270: DataDog::DogStatsd versions through 0.07 for Perl allow metric injections (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-11362: DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-10725: Protocol::HTTP2 versions through 1.12 for Perl is vulnerable to a HTTP/2 Bomb (Robert Rothenberg <rrwo@...nsec.org>)

June 7 (1 message)

CVE-2026-47430: Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from … (Niklas Merz <niklasmerz@...che.org>)

June 8 (17 messages)

rsync 3.4.4 released, regression fixes (Andrew Tridgell <tridge60@...il.com>)
Re: libinput: libinput-device-group unescaped phys output can inject udev properties (Salvatore Bonaccorso <carnil@...ian.org>)
offlineimap 8.0.3 fixes CVE-2020-37248 (STARTTLS stripping) (Sebastian Pipping <sebastian@...ping.org>)
CVE-2026-29167: Apache HTTP Server: mod_ldap per-dir use-after-free (Eric Covener <covener@...che.org>)
CVE-2026-29170: Apache HTTP Server: mod_proxy_ftp XSS (Eric Covener <covener@...che.org>)
CVE-2026-34355: Apache HTTP Server: mod_proxy_html buffer overflow (Eric Covener <covener@...che.org>)
CVE-2026-34356: Apache HTTP Server: ProxyPassReverseCookieMap buffer overflow (Eric Covener <covener@...che.org>)
CVE-2026-42535: Apache HTTP Server: mod_dav_fs protected directory access (Eric Covener <covener@...che.org>)
CVE-2026-42536: Apache HTTP Server: mod_xml2enc heap overflow (Eric Covener <covener@...che.org>)
CVE-2026-43951: Apache HTTP Server: OOB Read in `merge_response_headers` can cause crash (Eric Covener <covener@...che.org>)
CVE-2026-44119: Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modules (Eric Covener <covener@...che.org>)
CVE-2026-44185: Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request` (Eric Covener <covener@...che.org>)
CVE-2026-44186: Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp (Eric Covener <covener@...che.org>)
CVE-2026-44631: Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char Overflow (Eric Covener <covener@...che.org>)
CVE-2026-48913: Apache HTTP Server: mod_http2 memory corruption when file handles exhausted (Eric Covener <covener@...che.org>)
CVE-2026-49975: Apache HTTP Server: mod_http2 denial of service (Eric Covener <covener@...che.org>)
[CVE-2026-9669] CPython: bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 9 (15 messages)

Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) ("David A. Wheeler" <dwheeler@...eeler.com>)
CVE-2026-34905: Apache Answer: Unlisted Questions Accessible via Direct API Access (Enxin Xie <linkinstar@...che.org>)
CVE-2026-34033: Apache Answer: HTML Content Injection in Email (Enxin Xie <linkinstar@...che.org>)
CVE-2026-34031: Apache Answer: The custom avatar was not properly validated (Enxin Xie <linkinstar@...che.org>)
CVE-2026-33582: Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error (Enxin Xie <linkinstar@...che.org>)
CVE-2026-25699: Apache Answer: Authorization Bypass in Timeline API (Enxin Xie <linkinstar@...che.org>)
CVE-2026-25688: Apache Answer: XSS in AI Answer Rendering (Enxin Xie <linkinstar@...che.org>)
CVE-2026-49818: Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-9698: DBI versions before 1.648 for Perl saved errors in a limited-sized buffer (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2009-10007: Catalyst::Plugin::Authentication versions before 0.10_027 for Perl is susceptible to session fixation atta… (Robert Rothenberg <rrwo@...nsec.org>)
Xen Security Advisory 491 v2 (CVE-2026-42487) - x86 HVM I/O port list traversal (Xen.org security team <security@....org>)
Xen Security Advisory 492 v3 (CVE-2026-42489,CVE-2026-42490) - domctl lock open to abuse (Xen.org security team <security@....org>)
Xen Security Advisory 493 v2 (CVE-2025-10263) - Arm: Completion of memory accesses not guaranteed by completion of a TL… (Xen.org security team <security@....org…)
Xen Security Advisory 494 v3 (CVE-2026-42488) - x86: mismatched mapcache metadata (Xen.org security team <security@....org>)
OpenSSL Security Advisory (Tomas Mraz <tomas@...nssl.foundation>)

June 10 (22 messages)

How to request CVE numbers? (Hauke Mehrtens <hauke@...ke-m.de>)
ldns insufficiently verifies that responses belong to a query (Willem Toorop <willem@...etlabs.nl>)
Re: How to request CVE numbers? (swing sze <bestswngs@...il.com>)
Re: How to request CVE numbers? (Marcus Meissner <meissner@...e.de>)
Re: How to request CVE numbers? (Christian Brabandt <cb@...bit.org>)
Multiple vulnerabilities in Jenkins (Daniel Beck <ml@...kweb.net>)
Re: How to request CVE numbers? (Lucas Holt <luke@...lishgames.com>)
Re: How to request CVE numbers? (Michael Freeman <mfreeman@...verauto.dev>)
Re: How to request CVE numbers? (Sam Bull <9m199i@...bull.org>)
CVE-2026-25700: Apache Answer: AdminToken not invalidated after admin deactivation (Enxin Xie <linkinstar@...che.org>)
Fwd: Node.js security updates for all active release lines, June 2026 (Rafael Gonzaga <work@...aelgss.dev>)
CVE-2026-47342: Apache OFBiz: Privilege Escalation via updateOrRemove Authorization Bypass (Jacopo Cappellato <jacopoc@...che.org>)
CVE-2026-50223: Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Co… (Jacopo Cappellato <jacopoc@...che.org>)
Re: Fwd: Node.js security updates for all active release lines, June 2026 (h <h@...er.ee>)
Re: Local privilege escalation in Lix and Nix (Thomas GERBET <thomas@...bet.me>)
ITScape: Guest-to-Host Escape in KVM/arm64 (CVE-2026-46316) (Hyunwoo Kim <imv4bel@...il.com>)
CVE-2026-50637: Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-50638: Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-50639: Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-45257: FreeBSD kTLS-RX in-place AES-GCM decrypt over sendfile(2) EXTPG mbufs to page-cache write / local root (bumsrakete <bumsrakede@...ton.me>)
Re: CVE-2026-45257: FreeBSD kTLS-RX in-place AES-GCM decrypt over sendfile(2) EXTPG mbufs to page-cache write / local root (Lucas Holt <luke@...lishgames.com>)
Re: How to request CVE numbers? (Hauke Mehrtens <hauke@...ke-m.de>)

June 11 (12 messages)

Re: How to request CVE numbers? (Securin Disclose <disclose@...urin.io>)
CVE-2026-49875: Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50623: Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50627: Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50628: Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50629: Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50630: Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50631: Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50632: Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50633: Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50634: Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-50645: Apache CXF: No restriction on attachment headers per message (Colm O hEigeartaigh <coheigea@...che.org>)

June 12 (5 messages)

Squid CVE-2026-47729 and CVE-2026-50012 (Amos Jeffries <squid3@...enet.co.nz>)
CVE-2026-33590: Insecure default settings of Portainer < 2.38.0 allow host takeover (Dimitris Glynos <dglynos@...wave.com>)
CVE-2017-20240: Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-9638: Crypt::PBKDF2 versions before 0.261630 for Perl generate insecure random values for salts (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations (Robert Rothenberg <rrwo@...nsec.org>)

June 13 (22 messages)

Re: CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iteratio… (Peter Gutmann <pgut001@...auckland.ac.n…)
CVE-2026-41579: runc allows a malicious image with a /dev symlink to trigger limited host filesystem integrity violations (Aleksa Sarai <cyphar@...har.com>)
CVE-2025-55644: Use-After-Free in GPAC/MP4Box via gf_node_get_tag on crafted MP4 file with invalid BIFS GlobalQuantizer command (shvedov@....com)
CVE-2025-55652: Heap-based Buffer Overflow in GPAC/MP4Box via gf_isom_vp_config_new on crafted MP4 with malformed VP codec configuration (shvedov@....com)
CVE-2025-55643: NULL Pointer Dereference in GPAC/MP4Box via TrackWriter handling on crafted MP4 with malformed mvcC/stsz metadata during DASH … (shvedov@....com)
CVE-2025-55645: Heap-based Buffer Overflow in GPAC/MP4Box via gf_cenc_set_pssh on crafted MP4 with oversized PSSH payload (shvedov@....com)
CVE-2025-55647: Integer Overflow in GPAC/MP4Box via mp4_mux_cenc_insert_pssh on crafted MP4 with oversized PSSH metadata (shvedov@....com)
CVE-2025-55642: Divide by Zero in GPAC/MP4Box via avidmx_process on crafted AVI input with zero declared frames (shvedov@....com)
CVE-2025-55641: NULL Pointer Dereference in GPAC/MP4Box via gf_isom_copy_sample_info on crafted MP4 file with corrupted SAI metadata (shvedov@....com)
CVE-2025-55648: Heap-based Buffer Overflow in GPAC/MP4Box via gf_opus_parse_packet_header on crafted MP4 with corrupted stsz data (shvedov@....com)
CVE-2025-55649: NULL Pointer Dereference in GPAC/MP4Box via gf_media_map_esd on crafted MP4 with corrupted ESD data (shvedov@....com)
CVE-2025-55650: Use-After-Free in GPAC/MP4Box via gf_svg_node_del on crafted MP4 file processed with -svg (shvedov@....com)
CVE-2025-55661: Heap-based Buffer Overflow in GPAC/MP4Box via gf_opus_parse_packet_header on crafted MP4 file with malformed Opus packet (shvedov@....com)
CVE-2025-55663: NULL Pointer Dereference in GPAC/MP4Box via Track_SetStreamDescriptor on crafted MP4 with unknown svcC box in av01 (shvedov@....com)
CVE-2025-55660: Stack-based Buffer Overflow in GPAC/MP4Box via gf_opus_read_length on crafted MP4 file with malformed Opus packet (shvedov@....com)
CVE-2025-55657: NULL Pointer Dereference in GPAC/MP4Box via gf_odf_vvc_cfg_write_bs on crafted MP4 file with unsupported vvc16 box (shvedov@....com)
CVE-2025-55659: NULL Pointer Dereference in GPAC/MP4Box via ctts_box_write on crafted MP4 file with negative timestamps (shvedov@....com)
CVE-2025-55651: NULL Pointer Dereference in GPAC/MP4Box via gf_isom_get_user_data_count on truncated MP4 input (shvedov@....com)
CVE-2025-52293: Out-of-bounds Read in GPAC/MP4Box via gf_hevc_read_sps_bs_internal on crafted HEVC SPS in MP4 file (shvedov@....com)
CVE-2025-55662: Divide by Zero in GPAC/MP4Box via gf_opus_parse_packet_header on crafted MP4 file with malformed Opus header (shvedov@....com)
CVE-2025-52292: Stack-based Buffer Overflow in GPAC/MP4Box via filein_process on crafted MP4 file during DASH segmentation (shvedov@....com)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Solar Designer <solar@...nwall.com>)

June 14 (5 messages)

Re: CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations (Jacob Bachmeyer <jcb62281@...il.com>)
Re: CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iteratio… (Peter Gutmann <pgut001@...auckland.ac.n…)
Re: CVE-2026-9641: Crypt::PBKDF2 versions before 0.261630 for Perl have a weak default algorithm and number of iterations (Harry Sintonen <sintonen@....fi>)
CVE-2026-11526: GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename argu… (Paul Johnson <paul@...j.net>)
CVE-2026-11527: Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open(… (Paul Johnson <paul@...j.net>)

June 15 (11 messages)

Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Stuart Henderson <stu@...cehopper.org>)
Re: Squid CVE-2026-47729 and CVE-2026-50012 (Amos Jeffries <squid3@...enet.co.nz>)
CVE-2026-12205: Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recove… (Timothy Legge <timlegge@...nsec.org>)
Re: How to request CVE numbers? (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Alan Coopersmith <alan.coopersmith@...cle.com>)
tmux 3.6b fixes CVE-2026-11623 (Alan Coopersmith <alan.coopersmith@...cle.com>)
[vim-security] Out-of-bounds Write in Spell File Word Count in Vim < 9.2.0653 (Christian Brabandt <cb@...bit.org>)
[OSSA-2026-017] Errata 1: Ironic: Script injection during node boot via linux command line override (CVE-2026-46447) (Jay Faulkner <jay@....cc>)
CVE-2026-12087: Socket versions before 2.041 for Perl have an out-of-bounds heap read (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-11832: Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce (Robert Rothenberg <rrwo@...nsec.org>)

June 16 (13 messages)

Fwd: gsasl-2.2.4 released - fixes heap disclosure (Alan Coopersmith <alan.coopersmith@...cle.com>)
'rcp' and friends meet escape characters and quoting (Collin Funk <collin.funk1@...il.com>)
CVE-2026-50203: Apache Airflow SFTP provider: Path traversal in SFTPHook.retrieve_directory allows local file write outside th… (Jarek Potiuk <potiuk@...che.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Prentice Bisbal <prentice@...r.edu>)
[OSSA-2026-022] OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constra… (Goutham Pacha Ravi <gouthampravi@...il.…)
Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649) (Marco Benatto <mbenatto@...hat.com>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (3v <ventic@...fi>)
[CVE-2026-12003] CPython In-tree (development) search paths can be enabled without modifying install directory (Alan Coopersmith <alan.coopersmith@...cle.com>)
OpenBSD sppp_pap_input: PAP authentication bypass (shj <shahriyar@...eray.co.uk>)
[OSSA-2026-023] Ironic: Sensitive properties returned unredacted in POST and PATCH HTTP responses (CVE-2026-54421) (Jay Faulkner <jay@....cc>)
[OSSN-0100] Ironic: Command Injection in IPA (CVE-2026-43003) (Jay Faulkner <jay@....cc>)
[vim-security] Out-of-bounds Write in Spell File Prefix Dump in Vim < 9.2.0662 (Christian Brabandt <cb@...bit.org>)
[vim-security] Vimscript Code Injection in netrw NetrwLocalRmFile() via crafted filename affects Vim < 9.2.0663 (Christian Brabandt <cb@...bit.org>)

June 17 (10 messages)

[CVE-2026-36849] libtiff: Denial of Service via large SamplesPerPixel tag (Ryo utomo <utomoryo395@...il.com>)
CVE-2026-32966: Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Dis… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-32967: Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-42357: Apache DolphinScheduler: Incorrect Authorization vulnerability allows users to access workflow instance informa… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-47340: Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert i… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-49050: Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-41280: Apache DolphinScheduler: Incorrect Authorization vulnerability allows users with system login privileges to del… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-49268: Apache Shiro: LDAP DN Injection in DefaultLdapRealm (Lenny Primak <lprimak@...che.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) ("David A. Wheeler" <dwheeler@...eeler.com>)
[vim-security] Out-of-bounds Read in Text Property Count in Vim < 9.2.0670 (Christian Brabandt <cb@...bit.org>)

June 18 (7 messages)

[CVE-2026-43495] Linux kernel: slab out-of-bounds read in MediaTek t7xx WWAN driver (Pavitra Jha <jhapavitra98@...il.com>)
Re: How to request CVE numbers? (Marta Rybczynska <rybczynska@...il.com>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Sylvain Beucler <beuc@...c.net>)
Fwd: Node.js security updates for all active release lines, June 2026 (Rafael Gonzaga <work@...aelgss.dev>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Jeremy Stanley <fungi@...goth.org>)
CVE-2026-9692: Mojolicious::Sessions::Storable versions through 0.05 for Perl generate session ids insecurely (Robert Rothenberg <rrwo@...nsec.org>)
[vim-security] Out-of-bounds Read with libsodium-encrypted Files in Vim < 9.2.0671 (Christian Brabandt <cb@...bit.org>)

June 19 (16 messages)

Re: Squid CVE-2026-47729 and CVE-2026-50012 (Alan Coopersmith <alan.coopersmith@...cle.com>)
[containerd] Patch releases addressing CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, and CVE-2026-47262 (Samuel Karp <sam@...uelkarp.com>)
OpenBSD mpls_do_error: Remote Kernel Stack Disclosure via MPLS Label Stack Over-read (shj <shahriyar@...eray.co.uk>)
CVE-2026-39998: Apache APISIX: Identity Injection via forward-auth Plugin Missing Header Cleanup (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-39999: Apache APISIX: JWT Algorithm Confusion allows authentication bypass (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-44046: Apache APISIX: wolf-rbac plugin Identity Spoofing (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-44087: Apache APISIX: Openid-connect plugin Identity Header Spoofing (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-44915: Apache APISIX: Cas-auth plugin open redirect via unsanitized cookie value (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-47339: Apache APISIX: authz-casdoor incorrect session sharing (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-47341: Apache APISIX: Session replay issue in hmac-auth (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-48895: Apache APISIX: Cas-auth Host header influence on CAS service URL (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-49230: Apache APISIX: Authentication bypass in jwe-decrypt (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-49231: Apache APISIX: Identity spoofing issue in APISIX opa plugin (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-49871: Apache APISIX: cas-auth login CSRF / session injection issue (Abhishek Choudhary <shreemaanabhishek@...che.org>)
CVE-2026-49872: Apache APISIX: Improper authentication in cas-auth plugin (Abhishek Choudhary <shreemaanabhishek@...che.org>)
Re: Fwd: Node.js security updates for all active release lines, June 2026 (Solar Designer <solar@...nwall.com>)

June 20 (7 messages)

CVE-2025-62198: Apache Atlas: Stored XSS in Create Entity page (Madhan Neethiraj <madhan@...che.org>)
[vim-security] PowerShell Command Injection in zip.vim via Crafted Archive Entry Names in Vim > 9.1.1783 && Vim < 9.2.0678 (Christian Brabandt <cb@...bit.org>)
[vim-security] Out-of-bounds Read with Text Properties in Vim >= 9.2.0320 && Vim < 9.2.0679 (Christian Brabandt <cb@...bit.org>)
CVE-2026-44911: Apache NiFi: Incorrect Authorization for Configuration Verification Requests (David Handermann <exceptionfactory@...che.org>)
CVE-2026-44913: Apache NiFi: Improper Escaping of Table Names in CaptureChangeMySQL (David Handermann <exceptionfactory@...che.org>)
CVE-2026-44914: Apache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents (David Handermann <exceptionfactory@...che.org>)
CVE-2026-54665: Apache NiFi: Missing Validation for Proxy Host Headers (David Handermann <exceptionfactory@...che.org>)

June 21 (2 messages)

[vim-security] Out-of-bounds Write in SOFO Soundfolding in Vim < 9.2.0698 (Christian Brabandt <cb@...bit.org>)
[vim-security] Arbitrary Code Execution via Python Omni-Completion Docstrings in Vim < 9.2.0699 (Christian Brabandt <cb@...bit.org>)

June 22 (7 messages)

CVE-2025-66336: Apache Doris MCP Server: SQL injection leading the authentication bypass (Calvin Kirs <kirs@...che.org>)
Re: Squid CVE-2026-47729 and CVE-2026-50012 (Salvatore Bonaccorso <carnil@...ian.org>)
CVE-2026-6653: libxml2: use after free in xmlParseInternalSubset (>=2.9.11, <2.11.0) (Sudhakar Verma <sudhakar.verma@...onical.com>)
CVE-2026-11373: Net::Statsite::Client versions through 1.1.0 for Perl allow metric injections (Robert Rothenberg <rrwo@...nsec.org>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Sylvain Beucler <beuc@...c.net>)
Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse) (Jeremy Stanley <fungi@...goth.org>)
Common PKCS#7 / CMS parsing issues in OpenSSL, WolfSSL, Bouncy Castle, & GnuPG (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 23 (11 messages)

CVE-2026-9733: Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parame… (Robert Rothenberg <rrwo@...nsec.org>)
pwnlift: symlink following and TOCTOU in privileged upload handler allow arbitrary file write as root (GregD <gregdurys.security@...ton.me>)
Re: Common PKCS#7 / CMS parsing issues in OpenSSL, WolfSSL, Bouncy Castle, & GnuPG (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2026-55556: rsyslog imhttp Basic Auth heap overflow (Rainer Gerhards <rgerhards@...adiscon.com>)
[OSSA-2026-024] OpenStack Swift: Swift proxy-server SSRF via header injection (CVE-2026-50221) (Goutham Pacha Ravi <gouthampravi@...il.com>)
[CVE-2026-11940] Cpython: tarfile extraction filter bypass allows escaping the destination directory (Alan Coopersmith <alan.coopersmith@...cle.com>)
[CVE-2026-50160] Hoppscotch: Unauthenticated JWT Secret Overwrite (CVSS 10.0) (Aditi Bhatnagar <aditi@...gridsec.com>)
icalendar: Denial of Service CVE-2026-55099 (Maurits van Rees <maurits@...rees.org>)
Plone: various security fixes 20260623 (Maurits van Rees <maurits@...rees.org>)
libssh2: CVE-2026-55200 (critical), CVE-2025-15661 (high), CVE-2026-55199 (high) (James Addison <james@...iperadar.com>)
Re: libssh2: CVE-2026-55200 (critical), CVE-2025-15661 (high), CVE-2026-55199 (high) (Alan Coopersmith <alan.coopersmith@...cle.com>)

June 24 (9 messages)

[SECURITY ADVISORIES] for curl 8.21.0 (Daniel Stenberg <daniel@...x.se>)
Re: Squid CVE-2026-47729 and CVE-2026-50012 (Christian Fischer <christian.fischer@...enbone.net>)
Re: libssh2: CVE-2026-55200 (critical), CVE-2025-15661 (high), CVE-2026-55199 (high) (Sevan Janiyan <venture37@...klan.co.uk>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Re: Squid CVE-2026-47729 and CVE-2026-50012 (Rolf Reintjes <rolf.reintjes@....de>)
Re: libssh2: CVE-2026-55200 (critical), CVE-2025-15661 (high), CVE-2026-55199 (high) (Sevan Janiyan <venture37@...klan.co.uk>)
CVE-2026-56091: Apache Shiro: Authentication bypass in Guice-Web integration (Lenny Primak <lprimak@...che.org>)
CVE-2026-56130: Apache Shiro: Remember-me cookie isn't checked for expiry on the server (Lenny Primak <lprimak@...che.org>)
[vim-security] Out-of-bounds Write in SAL Soundfolding in Vim < 9.2.0725 (Christian Brabandt <cb@...bit.org>)

June 25 (11 messages)

CVE-2026-41566: Apache Kvrocks: Improper permission for the APPLYBATCH command (Hulk Lin <hulk@...che.org>)
CVE-2026-45188: Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling (Hulk Lin <hulk@...che.org>)
CVE-2026-46751: Apache Kvrocks: Does not remove the unsafe loadstring function from its Lua sandbox, allowing a user who can run EVA… (Hulk Lin <hulk@...che.org>)
CVE-2026-46752: Apache Kvrocks: Stack buffer overflow in Lua bit.tohex() (Hulk Lin <hulk@...che.org>)
CVE-2026-54226: Apache Kvrocks: RESTORE IntSet Integer Overflow Leads to Remote DoS (Hulk Lin <hulk@...che.org>)
PowerDNS Security Advisory 2026-07: Insufficient input validation of internal web server (Miod Vallat <miod.vallat@...erdns.com>)
PowerDNS Security Advisory 2026-08 for PowerDNS Recursor: Multiple issues (Otto Moerbeek <otto.moerbeek@...erdns.com>)
PowerDNS Security Advisory 2026-09 for DNSdist: Multiple issues (Remi Gacogne <remi.gacogne@...erdns.com>)
Several vulnerabilities were found in NLnet Labs NSD (Willem Toorop <willem@...etlabs.nl>)
libexpat 2.8.2 fixes 14 vulnerabilities (integer overflow, out-of-bounds write, ..) (Sebastian Pipping <sebastian@...ping.org>)
CVE-2026-12844: List::SomeUtils::XS versions before 0.59 for Perl have a heap buffer overflow in the pairwise function (Paul Johnson <paul@...j.net>)

June 26 (8 messages)

CVE-2026-49486: Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P) (Shahar Epstein <shahar@...che.org>)
CVE-2025-55639: NULL Pointer Dereference in GPAC/MP4Box via gf_isom_add_track_kind on crafted MP4 file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-60471: Use-After-Free in GPAC/MP4Box via gf_filter_pid_reconfigure_task_discard on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-60464: NULL Pointer Dereference in GPAC/MP4Box via gf_sei_load_from_state_internal on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2026-11625: Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-11702: Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-57914: Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-57915: Apache Kerby: Kerberos Pre-Authentication Bypass (Colm O hEigeartaigh <coheigea@...che.org>)

June 27 (8 messages)

CVE-2025-60465: Use-After-Free in GPAC/MP4Box via gf_filter_pid_inst_swap on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-60466: Expired Pointer Dereference in GPAC/MP4Box via gf_filter_pid_get_packet on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-60473: NULL Pointer Dereference in GPAC/MP4Box via gf_filter_in_parent_chain on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-60467: Use-After-Free in GPAC/MP4Box via gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-60474: Heap-based Buffer Overflow in GPAC/MP4Box via gf_media_import on crafted MPEG-2 TS file ("Alexander A. Shvedov" <shvedov@....fr>)
[vim-security] Arbitrary Code Execution via C Omni-Completion in Vim < 9.2.0735 (Christian Brabandt <cb@...bit.org>)
n8n: SSRF remains exploitable in default configuration (incomplete fix, no CVE) (Akshat Sinha <akshat.snh@...il.com>)
fetchmail's NTLM authentication vulnerable to stack buffer overflow up to release 6.6.6 (FW: The 6.6.7.rc1 release cand… (Matthias Andree <matthias.andree@....de…)

June 28 (2 messages)

[vim-security] Arbitrary Code Execution via PHP Omni-Completion in Vim < 9.2.0736 (Christian Brabandt <cb@...bit.org>)
[Security advisory] FreeHSM C v1.1.0 - v1.2.1 : raw CKM_ECDSA signatures not externally verifiable (fixed in v1.2.2 ; v1.3.… (Afchine Mad <afchine.mad@...il.com>)

June 29 (26 messages)

Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (Andreas Gruenbacher <agruenba@...hat.com>)
Re: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl (Michael Orlitzky <michael@...itzky.com>)
CVE-2023-0645: libjxl/cjxl out-of-bounds read in EXIF metadata parsing ("Alexander A. Shvedov" <shvedov@....fr>)
CVE-2025-70099: lwext4 NULL pointer dereference in ext4_dir_en_get_name_len (shvedov@....com)
CVE-2025-70100: lwext4 divide-by-zero in ext4_block_set_lb_size (shvedov@....com)
CVE-2025-70101: lwext4 out-of-bounds read in ext4_ext_binsearch_idx (shvedov@....com)
CVE-2026-49432: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables deni… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-49434: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied … ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-49877: Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console ("Christopher L. Shannon" <cshannon@...che.org>)
CVE-2026-50734: Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-alloca… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-50750: Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-52760: Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-53916: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec… ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-53917: Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory … ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-54475: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover ("Christopher L. Shannon" <cshannon@...c…)
CVE-2026-56017: JavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the firs… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-56018: JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unb… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13593: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified aw… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13758: CryptX versions before 0.088_001 for Perl compare AEAD authentication tags in non-constant time in the streaming … (Stig Palmquist <stig@...g.io>)
CVE-2026-50229: Apache Tomcat: XSS in number guess example (Mark Thomas <markt@...che.org>)
CVE-2026-53404: Apache Tomcat: Bad ornext processing in RewriteValve (Mark Thomas <markt@...che.org>)
CVE-2026-53434: Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector (Mark Thomas <markt@...che.org>)
CVE-2026-55276: Apache Tomcat: Logged effective web.xml is incomplete (Mark Thomas <markt@...che.org>)
CVE-2026-55955: Apache Tomcat: EncryptInterceptor not protected against replay attacks (Mark Thomas <markt@...che.org>)
CVE-2026-55956: Apache Tomcat: Security constraints for default servlet ignored method (Mark Thomas <markt@...che.org>)
CVE-2026-55957: Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind (Mark Thomas <markt@...che.org>)

June 30 (4 messages)

hostapd: OOB write in Wi-Fi 7 MLD association parsing (pre-auth DoS) (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
CVE-2025-53648: Apache Gravitino: SQL misconfiguration can access or truncate files (Jerry Shao <jshao@...che.org>)
CVE-2026-57079 through CVE-2026-57082: Multiple vulnerabilities in Net::BitTorrent versions through 2.0.1 for Perl (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-13766: DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers (Robert Rothenberg <rrwo@...nsec.org>)

319 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.