oss-security mailing list - 2026/09

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [next month>] [year] [list]

oss-security mailing list - 2026/09

Mon	Tue	Wed	Thu	Fri	Sat	Sun
	¹ 4	² 5	³ 6	⁴ 7	⁵ 5	⁶ 4
⁷ 2	⁸ 24	⁹ 5	¹⁰ 19	¹¹ 11	¹² 4	¹³ 23
¹⁴ 32	¹⁵ 15	¹⁶ 16	¹⁷ 6	¹⁸ 17	¹⁹ 7	²⁰ 3
²¹ 9	²² 24	²³ 36	²⁴ 17	²⁵ 25	²⁶ 2	²⁷
²⁸ 14	²⁹ 40	³⁰ 18

Messages by day:

September 1 (4 messages)

Re: CVE-2026-19873: HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count fr… (Robert Rothenberg <rrwo@...nsec.org>)
FreeRDP <= 3.30.0: five server-side vulnerabilities fixed in 3.31.0, pre-auth RCE demonstrated (Samuel Page <sam@...ar.io>)
CVE-2026-80205 : ReDoS in NLTK Text.findall() (CVSS 8.7 High) (Aditi Bhatnagar <aditi@...gridsec.com>)
CVE-2026-32773: Apache Spark: XSS Vulnerability in Spark Web 3.5.4 (Holden Karau <holden@...che.org>)

September 2 (5 messages)

CVE-2026-81928: Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re… (Timothy Legge <timlegge@...nsec.org>)
[SECURITY ADVISORIES] curl 8.22.0 (Daniel Stenberg <daniel@...x.se>)
Re: Fwd: [Announce] Libgcrypt 1.12.3 released (Sam James <sam@...too.org>)
Multiple vulnerabilities in Jenkins and Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Fwd: Vulnerabilities in golang.org/x/crypto (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 3 (6 messages)

CVE-2026-80530: Linux XFS EXCHANGE_RANGE reflink flag clearing leading to local privilege escalation (Lin Jiapeng <ljp1205831794@...il.com>)
[OSSA-2026-038] OpenStack Glance: Multiple SSRF vulnerabilities in web-download and HTTP image APIs (CVE-2026-71196, CV… (Goutham Pacha Ravi <gouthampravi@...il.…)
CVE-2026-80180: Apache Allura: Stored XSS via markdown HTML processing (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-80181: Apache Allura: Server-side request forgery (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-80190: Apache Allura: Stored XSS via code repositories (Dave Brondsema <dave@...ndsema.net>)
CVE-2026-81270: Apache Allura: Information exposure via search (Dave Brondsema <dave@...ndsema.net>)

September 4 (7 messages)

CVE-2026-71216: Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP (Kai Wan <wankai@...che.org>)
CVE-2026-85229: Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057) (Sheng Wu <wusheng@...che.org>)
CVE-2026-82309: Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per valid… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-52691: Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module (Arnout Engelen <engelen@...che.org>)
Vulnerabilities fixed in libxml2-2.15.4 (Sam James <sam@...too.org>)
Vulnerability fixes in util-linux-2.42.3 (Sam James <sam@...too.org>)
pcre2 version 10.48 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 5 (5 messages)

Re: Fwd: [Freeipmi-announce] FreeIPMI 1.6.19 Released (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Vulnerability fixes in util-linux-2.42.3 (Salvatore Bonaccorso <carnil@...ian.org>)
Re: pcre2 version 10.48 released with security fixes (Salvatore Bonaccorso <carnil@...ian.org>)
Re: Vulnerabilities fixed in libxml2-2.15.4 (Salvatore Bonaccorso <carnil@...ian.org>)
Fwd: Security vulnerabilities fixed in WeeChat 4.10.1 (Sam James <sam@...too.org>)

September 6 (4 messages)

CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses vi… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write (Stefan Bodewig <bodewig@...che.org>)
Fwd: [mapserver-announce] security release available: MapServer 8.6.6 (Sam James <sam@...too.org>)
CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assert… (Timothy Legge <timlegge@...nsec.org>)

September 7 (2 messages)

CVE-2026-86287: Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state… (Robert Rothenberg <rrwo@...nsec.org>)

September 8 (24 messages)

Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more (Yuan Tan <yuant@...usec.ai>)
CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks (Dániel Dékány <ddekany@...che.org>)
CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) (Sebastian Nagel <snagel@...che.org>)
CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST AP… (Sebastian Nagel <snagel@...che.org>)
CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) (Sebastian Nagel <snagel@...che.org>)
Xen Security Advisory 509 v3 (CVE-2026-62437) - x86: DMs may cause mem leak by IRQ binding (Xen.org security team <security@....org>)
Xen Security Advisory 510 v3 (CVE-2026-79602) - x86: improper handling of HVM emulation return codes (Xen.org security team <security@....org>)
Xen Security Advisory 511 v3 (CVE-2026-79603) - Unconditionally do TLB flushing ahead of page scrubbing (Xen.org security team <security@....org>)
Xen Security Advisory 512 v3 (CVE-2026-79604) - oxenstored: Unbounded accumulation of watches (Xen.org security team <security@....org>)
Xen Security Advisory 513 v3 (CVE-2026-79605,CVE-2026-79606) - Out-of-bounds accesses in Tapdisk (Xen.org security team <security@....org>)
CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validati… (Gidon Gershinsky <gg5070@...il.com>)
CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId (Matt Pavlovich <mattrpav@...che.org>)
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant aut… (Niko Oliveira <onikolas@...che.org>)
Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more ("Dr. Thomas Orgis" <thomas.orgis@...-hamburg.de>)
CVE-2026-19872: HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rende… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85484: HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels int… (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85485: HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85630: HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping usi… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more (Dominique Martinet <asmadeus@...ewreck.org>)
Fwd: Tor Project Forum: Security Release 0.4.9.12 (Sam James <sam@...ct.info>)
CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery (Michael Smith <michaelsmith@...che.org>)
CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token (Michael Smith <michaelsmith@...che.org>)
CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF (Michael Smith <michaelsmith@...che.org>)
CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading (Michael Smith <michaelsmith@...che.org>)

September 9 (5 messages)

Security fixes in libfuse-3.18.3 (Sam James <sam@...too.org>)
libpcap 1.10.7 fixes 7 vulnerabilities (Denis Ovsienko <denis@...ienko.info>)
Re: bubblewrap 0.12.0 fixes writes outside sandbox (Simon McVittie <smcv@...ian.org>)
CVE-2026-37171: SuperTokens Core cross-tenant session isolation bypass (6.0.0-11.4.0) ("Mr. Gatto" <drew.morana@...il.com>)
Fwd: XZ Utils 5.8.4 and a security fix (Sam James <sam@...too.org>)

September 10 (19 messages)

CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unautho… (Clebert Suconic <clebertsuconic@...che.…)
CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Top… (Clebert Suconic <clebertsuconic@...che.…)
CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered P… (Clebert Suconic <clebertsuconic@...che.…)
CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to… (Clebert Suconic <clebertsuconic@...che.…)
CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment (Clebert Suconic <clebertsuconic@...che.…)
CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in qu… (Clebert Suconic <clebertsuconic@...che.…)
CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of ser… (Clebert Suconic <clebertsuconic@...che.…)
Postfix: SMTP smuggling, remote crash, and hardening fixes in 3.11.7 and related legacy releases (Solar Designer <solar@...nwall.com>)
Memory-safety defects in the upstream (abandoned) AOSP OpenCORE AAC decoder, shipped unpatched by Samsung TizenRT (Eve <ckr927414@...k.li>)
Survey of filesystem MCP servers: how the "sandboxed filesystem" boundary is enforced (one breach, four defended-by-design) (Eve <ckr927414@...k.li>)
iceener/files-stdio-mcp-server: sandbox escape in fs_search via a symlinked directory (recursive walker validates only the top level) (Eve <ckr927414@...k.li>)
AI slops from Eve (Solar Designer <solar@...nwall.com>)
GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod (Pasquale Congiusti <pcongiusti@...che.org>)
CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary o… (Pasquale Congiusti <pcongiusti@...che.o…)
CVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operat… (Pasquale Congiusti <pcongiusti@...che.o…)
CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36 (Valtteri Vuorikoski <vuori@...com.org>)
Re: AI slops from Eve (Eli Schwartz <eschwartz@...too.org>)
Re: AI slops from Eve (Jeffrey Walton <noloader@...il.com>)

September 11 (11 messages)

Re: AI slops from Eve (Ellenor Bjornsdottir <ellenor/securesoftware@...rellix.net>)
The GNU C Library security advisory update for 2026-09-10 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXE (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
Re: AI slops from Eve (Martin Hecht <martin.hecht@...s.de>)
Re: AI slops from Eve (Solar Designer <solar@...nwall.com>)
Re: AI slops from Eve (Joe Krause <r29jk10@...il.com>)
Re: AI slops from Eve (Solar Designer <solar@...nwall.com>)
CPython: [CVE-2026-87910] tarfile hardlink fallback ignores custom extraction filter rejection via None (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns (Richard Zowalla <rzo1@...che.org>)
Re: pcre2 version 10.48 released with security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 12 (4 messages)

Local Privilege Escalation (LPE) in FolkPatch due to Hardcoded Default SuperKey (12345678 <a1489632@...ton.me>)
[vim-security] Ex Command Injection in sign_jump() in Vim < v9.2.1090 (Christian Brabandt <cb@...bit.org>)
Re: AI slops from Eve ("David A. Wheeler" <dwheeler@...eeler.com>)
Re: AI slops from Eve (Collin Funk <collin.funk1@...il.com>)

September 13 (23 messages)

Fwd: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations (Sam James <sam@...too.org>)
Re: UnrealIRCd 6.2.7 released & hot-patch to fix security issues for existing installations (Sam James <sam@...too.org>)
Retrospective by 'gpg.fail' authors (Sam James <sam@...too.org>)
Re: Retrospective by 'gpg.fail' authors (Peter Gutmann <pgut001@...auckland.ac.nz>)
GNU GRUB 2.14: serial-MMIO lockdown bypass in Canonical-signed gcdx64.efi (Luppa <essidleith@...il.com>)
CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launc… (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the T… (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users … (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC (Richard Zowalla <rzo1@...che.org>)
CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Depend… (Richard Zowalla <rzo1@...che.org>)
CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology P… (Richard Zowalla <rzo1@...che.org>)
Re: AI slops from Eve (Jeroen Roovers <jer@...all.nl>)
Re: AI slops from Eve (Solar Designer <solar@...nwall.com>)
Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only… (Gabriel Ravier <gabravier@...il.com>)

September 14 (32 messages)

Emacs arbitrary code execution: incomplete fix for CVE-2024-53920 (Sean Whitton <spwhitton@...hitton.name>)
CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access (Calvin Kirs <kirs@...che.org>)
CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables (Calvin Kirs <kirs@...che.org>)
CVE-2026-73178: Apache Syncope: JWT Access Token takeover (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name den… (Francesco Chicchiriccò <ilgrosso@...ch…)
CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-87785: Apache Syncope: JWT subject spoofing (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass (Francesco Chicchiriccò <ilgrosso@...che.org>)
graphql-go/graphql <= 0.8.1: quadratic CPU-exhaustion DoS via OverlappingFieldsCanBeMergedRule (Evgenios Gkritsis <evgeniosgkritsis@...il.com>)
Cpython: [CVE-2026-82049] tarfile extraction filters allow file modification and content disclosure via hard link to sy… (Alan Coopersmith <alan.coopersmith@...c…)
rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback (Evgenios Gkritsis <evgeniosgkritsis@...il.com>)
Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback ("David A. Wheeler" <dwheeler@...eeler.com>)
The GNU C Library security advisories update for 2026-09-14 (Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>)
Re: Retrospective by 'gpg.fail' authors (Clemens Lang <cllang@...hat.com>)

September 15 (15 messages)

CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution (manizada <manizada@...me>)
Re: Retrospective by 'gpg.fail' authors (Werner Koch <wk@...pg.org>)
CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay (Andor Molnar <andor@...che.org>)
CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode (Andor Molnar <andor@...che.org>)
CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persis… (Andor Molnar <andor@...che.org>)
CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources (Andor Molnar <andor@...che.org>)
CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider (Andor Molnar <andor@...che.org>)
CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity (Vincent Beck <vincbeck@...che.org>)
CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT (Vincent Beck <vincbeck@...che.org>)
CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access (Vincent Beck <vincbeck@...che.org>)
CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison i… (Vincent Beck <vincbeck@...che.org>)
CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions (Vincent Beck <vincbeck@...che.org>)
CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated (Vincent Beck <vincbeck@...che.org>)
CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key (Vincent Beck <vincbeck@...che.org>)
CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka co… (Vincent Beck <vincbeck@...che.org>)

September 16 (16 messages)

Re: Retrospective by 'gpg.fail' authors ("Lexi Groves (49016)" <contact@....fail>)
Re: Retrospective by 'gpg.fail' authors (Sam James <sam@...too.org>)
Unbound: 1.26.1 addresses multiple CVE items (Yorgos Thessalonikefs <yorgos@...etlabs.nl>)
ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-… (Nicki Křížek <nicki@....org>)
Multiple vulnerabilities in Jenkins plugins (Kevin Guerroudj <kguerroudj@...udbees.com>)
Re: Retrospective by 'gpg.fail' authors (Werner Koch <wk@...pg.org>)
CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests (David Handermann <exceptionfactory@...che.org>)
CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration (David Handermann <exceptionfactory@...che.org…)
CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods (David Handermann <exceptionfactory@...che.org>)
CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration (David Handermann <exceptionfactory@...che.org>)
CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles (David Handermann <exceptionfactory@...che.org>)
CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing (Volodymyr Siedlecki <volosied@...che.org>)
CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability (Volodymyr Siedlecki <volosied@...che.org>)
CVE-2026-89775: Guest-to-Host Escape in KVM/arm64 (Hyunwoo Kim <imv4bel@...il.com>)
Re: Retrospective by 'gpg.fail' authors (Soatok Dreamseeker <soatok.dhole@...il.com>)
CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2 (Haitam Lazaar <lazaar.haitam.official@...il.com>)

September 17 (6 messages)

Re: Retrospective by 'gpg.fail' authors (Peter Gutmann <pgut001@...auckland.ac.nz>)
Re: Retrospective by 'gpg.fail' authors (Werner Koch <wk@...pg.org>)
CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching (Jean-Baptiste Onofré <jbonofre@...che.org>)
The GNU C Library security advisories update for 2026-09-17 (Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>)
CVE-2026-73638: Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tif… (Stig Palmquist <stig@...g.io>)
CVE-2026-73639: Imager::File::PNG versions from 1.003 before 1.004 for Perl write past the end of the row buffer reading a PNG wi… (Stig Palmquist <stig@...g.io>)

September 18 (17 messages)

CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered … (Rahul Vats <rahulvats@...che.org>)
Re: Removing dead code (was: Retrospective by 'gpg.fail' authors) (Jacob Bachmeyer <jcb62281@...il.com>)
A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (manizada <manizada@...me>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Hanno Böck <hanno@...eck.de>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Valtteri Vuorikoski <vuori@...com.org>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Kevin Riggle <kevinr@...plexsystems.group>)
Re: Removing dead code (was: Retrospective by 'gpg.fail' authors) (Peter Gutmann <pgut001@...auckland.ac.nz>)
CVE-2026-93018: Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel inde… (Stig Palmquist <stig@...g.io>)
CVE-2026-93019: Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in… (Stig Palmquist <stig@...g.io>)
CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of servic… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion (Colm O hEigeartaigh <coheigea@...che.org…)
CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to de… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request in… (Colm O hEigeartaigh <coheigea@...che.or…)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Eli Schwartz <eschwartz@...too.org>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (SOFIA ETCHEPARE DARONCO <sofia.etchepare@...d.ufsm.br>)
Vulnerabilities in libheif and libde265 (Alan Coopersmith <alan.coopersmith@...cle.com>)

September 19 (7 messages)

Suricata 8.0.7 released with 67 vulnerabilities fixed (Alan Coopersmith <alan.coopersmith@...cle.com>)
Exim Security Release 4.100.1 (Solar Designer <solar@...nwall.com>)
Re: Suricata 8.0.7 released with 67 vulnerabilities fixed (Victor Julien <lists@...iniac.net>)
CVE-2026-78030: DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attribute… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Vulnerabilities in libheif and libde265 (Hanno Böck <hanno@...eck.de>)
CVE-2026-82560: Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over ne… (Stig Palmquist <stig@...g.io>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Greg Dahlman <dahlman@...il.com>)

September 20 (3 messages)

Re: Suricata 8.0.7 released with 67 vulnerabilities fixed (Sam James <sam@...too.org>)
rsyslog: mmpstrucdata denial of service fixed in 8.2606.0 (Rainer Gerhards <rgerhards@...adiscon.com>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Roman Fiedler <roman.fiedler@...aralleled.eu>)

September 21 (9 messages)

CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate (Emmanuel Lécharny <elecharny@...che.org>)
CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.1… (Emmanuel Lécharny <elecharny@...che.or…)
CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter (Rahul Vats <rahulvats@...che.org>)
CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixa… (Rahul Vats <rahulvats@...che.org>)
CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry (Rahul Vats <rahulvats@...che.org>)
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-202… (Goutham Pacha Ravi <gouthampravi@...il.…)
[OSSA-2026-040] OpenStack Blazar: Multiple authorization vulnerabilities in the Blazar V2 lease API (CVE-2026-93852, CV… (Goutham Pacha Ravi <gouthampravi@...il.…)
CVE-2026-93012: Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows se… (Stig Palmquist <stig@...g.io>)
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920 (Tomas Hoger <thoger@...hat.com>)

September 22 (24 messages)

CVE-2026-93709: Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses th… (Stig Palmquist <stig@...g.io>)
CVE-2026-93710: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception h… (Stig Palmquist <stig@...g.io>)
CVE-2026-93711: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array (Stig Palmquist <stig@...g.io>)
CVE-2026-93712: Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments … (Stig Palmquist <stig@...g.io>)
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill (Eli Schwartz <eschwartz@...too.org>)
Re: Vulnerabilities in libheif and libde265 (Hanno Böck <hanno@...eck.de>)
New OpenSSL Releases (Norbert Pócs <norbertp@...nssl.org>)
libexpat 2.8.5 fixes CVE-2026-93990 (malformed UTF-16 smuggling) (Sebastian Pipping <sebastian@...ping.org>)
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920 (Bas Alberts <anticomputer@...hub.com>)
CVE-2016-15059: Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the outpu… (Paul Johnson <paul@...j.net>)
CVE-2026-74765: Net::IDN::Punycode versions before 2.590 for Perl allow an out-of-bounds read via integer overflow of the delta ac… (Paul Johnson <paul@...j.net>)
CVE-2026-74766: Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point … (Paul Johnson <paul@...j.net>)
CVE-2026-87078: Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in dec… (Paul Johnson <paul@...j.net>)
CVE-2026-87079: Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding … (Paul Johnson <paul@...j.net>)
CVE-2026-87080: Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it… (Paul Johnson <paul@...j.net>)
CVE-2026-87081: Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong… (Paul Johnson <paul@...j.net>)
CVE-2026-87082: Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UT… (Paul Johnson <paul@...j.net>)
[OSSA-2026-039] OpenStack Octavia: HAProxy configuration injection leading to remote code execution in Octavia (CVE-202… (Goutham Pacha Ravi <gouthampravi@...il.…)
rsyslog imdtls permitted-peer authorization bypass (Rainer Gerhards <rgerhards@...adiscon.com>)
The GNU C Library security advisories update for 2026-09-22 (Carlos O'Donell <carlos@...hat.com>)
CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python cod… (Robert Rothenberg <rrwo@...nsec.org>)
Re: Flatpak 1.18.1 fixes multiple vulnerabilities (Simon McVittie <smcv@...ian.org>)
Re: bubblewrap 0.12.0 fixes writes outside sandbox (Simon McVittie <smcv@...ian.org>)
Re: xdg-dbus-proxy: GHSA-r7hp-698j-2h6c: broadcast message filtering bypass (Simon McVittie <smcv@...ian.org>)

September 23 (36 messages)

CVE-2026-94184: some builds of fetchmail 6.6.6 and older vulnerable to remote code execution in NTLM authentication cli… (Matthias Andree <matthias.andree@....de…)
Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code fro… (Sam James <sam@...too.org>)
Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python… (Robert Rothenberg <rrwo@...nsec.org>)
Vulnerabilities in ntfs-3g (Rostislav <rostislav@...era.com>)
xdg-dbus-proxy 0.1.9 fixes sandbox escape CVE-2026-94422 (Simon McVittie <smcv@...ian.org>)
Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920 (Tomas Hoger <thoger@...hat.com>)
Re: GNU Emacs vulnerability upon opening arbitrary file (Tomas Hoger <thoger@...hat.com>)
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence) (ezraax@...nds.app)
CVE-2026-82331: Apache BuildStream: tar source extraction escape (Jürg Billeter <juergbi@...che.org>)
CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service (Calvin Kirs <kirs@...che.org>)
CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution (Calvin Kirs <kirs@...che.org>)
CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-92001: Apache Sling XSS: Missing parser resource limits (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref() (Joerg Hoh <joerghoh@...che.org>)
CVE-2026-73581: Apache Tomcat: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (Mark Thomas <markt@...che.org>)
CVE-2026-75973: Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured (Mark Thomas <markt@...che.org>)
CVE-2026-76183: Apache Tomcat: Bypass of security constraints for WebSocket endpoints (Mark Thomas <markt@...che.org>)
CVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests (Mark Thomas <markt@...che.org>)
CVE-2026-77762: Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request (Mark Thomas <markt@...che.org>)
CVE-2026-77791: Apache Tomcat: DoS via busy wait during WebSocket close (Mark Thomas <markt@...che.org>)
CVE-2026-78383: Apache Tomcat: AJP DoS via missing request body (Mark Thomas <markt@...che.org>)
CVE-2026-78437: Apache Tomcat: HTTP/2 DoS via malformed request (Mark Thomas <markt@...che.org>)
CVE-2026-79677: Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout (Mark Thomas <markt@...che.org>)
CVE-2026-86248: Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fa… (Mark Thomas <markt@...che.org>)
CVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up (Mark Thomas <markt@...che.org>)
CVE-2026-87022: Apache Tomcat: WebSocket message smuggling with per-message-deflate (Mark Thomas <markt@...che.org>)
CVE-2026-86243: Apache Tomcat Native: DoS via TLS handshake (Mark Thomas <markt@...che.org>)
CVE-2026-86246: Apache Tomcat Native: Insecure OpenSSL options enabled (Mark Thomas <markt@...che.org>)
CVE-2026-86247: Apache Tomcat Native: Client certificate requirements can be down-graded (Mark Thomas <markt@...che.org>)
Re: Flatpak 1.18.1 fixes multiple vulnerabilities (Simon McVittie <smcv@...ian.org>)
[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation (Nathan Herz <nathan.herz97@...il.com>)
[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion (Nathan Herz <nathan.herz97@...il.com>)

September 24 (17 messages)

Re: Fwd: Tor Project Forum: Security Release 0.4.9.12 (Sam James <sam@...ct.info>)
Fwd: Tor Project Forum: Security Release 0.4.9.13 (Sam James <sam@...too.org>)
CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-96512: sudo: TZ still affects NOTBEFORE/NOTAFTER (Ermenson Junior <ermenson.sec@...il.com>)
[OSSA-2026-041] OpenStack Swift: Cross-container information disclosure via Swift tempurl (CVE-2026-97149) (Goutham Pacha Ravi <gouthampravi@...il.com>)
[OSSA-2026-042] OpenStack Zaqar: Zaqar empty URL-Signature header bypasses authentication (CVE-2026-97404) (Goutham Pacha Ravi <gouthampravi@...il.com>)
CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlle… (Jarek Potiuk <potiuk@...che.org>)
CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past… (Robert Rothenberg <rrwo@...nsec.org>)
Re: CVE-2026-85491: Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one … (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from a… (Robert Rothenberg <rrwo@...nsec.org>)
XSS vulnerability in <ansi2html-1.9.4 (Sam James <sam@...too.org>)
CVE-2026-92550: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the… (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the… (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-… (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conve… (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-92608: Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 (Daniil Kirilyuk <dakirily@...che.org>)
CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication (Daniil Kirilyuk <dakirily@...che.org>)

September 25 (25 messages)

CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthe… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-92289: Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying P… (Timothy Legge <timlegge@...nsec.org>)
CVE-2026-95811: Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2… (Timothy Legge <timlegge@...nsec.org>)
[NotCVE-2026-0014] Input Leap 3.0.3 Drag-and-Drop File Transfer Path Traversal Allows Arbitrary File Write Outside the Drop Directory (advisories@...cve.org)
Re: XSS vulnerability in <ansi2html-1.9.4 (Sebastian Pipping <sebastian@...ping.org>)
[NotCVE-2026-0015] Input Leap through 3.0.3 input-leapd Unauthenticated IPC Command Execution Allows Local Privilege Escalation to SYSTE… (advisories@...cve.org)
CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator ("David M. Johnson" <snoopdave@...che.org>)
CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX (Haitam Lazaar <contact.lazaar.haitam@...il.com>)

September 26 (2 messages)

CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction (Collin Funk <collin.funk1@...il.com>)
Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX (Simon McVittie <smcv@...ian.org>)

September 28 (14 messages)

[kubernetes] CVE-2026-19444: kubectl cp path traversal on Windows allows arbitrary file writes (Vyom Yadav <vyom.yadav@...onical.com>)
CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP login modules (Jean-Baptiste Onofré <jbonofre@...che.org>)
CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) (Jean-Baptiste Onofré <jbonofre@...che.org>)
crontab(1) silently truncates file path arguments >=100 chars (Vincent Lefevre <vincent@...c17.net>)
CVE-2026-85499: Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy (Hongtao Gao <hanahmily@...che.org>)
Flatpak 1.18.4 fixes multiple security vulnerabilities (Simon McVittie <smcv@...ian.org>)
The GNU C Library security advisory update for 2026-09-28 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation (Jean-Baptiste Onofré <jbonofre@...che.org>)
CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to re… (Jean-Baptiste Onofré <jbonofre@...che.…)
CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin (Jean-Baptiste Onofré <jbonofre@...che.org>)
CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations (Jean-Baptiste Onofré <jbonofre@...che.org>)
CVE-2026-88815: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-88816: DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName (Robert Rothenberg <rrwo@...nsec.org>)
CVE-2026-85644: XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference (Robert Rothenberg <rrwo@...nsec.org>)

September 29 (40 messages)

Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration (Muhammad Arslan Official <arslanqofficial@...il.…)
JIT buffer overflow fixed in libpcre2-10.49 (Sam James <sam@...too.org>)
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (Adrian Perez de Castro <aperez@...lia.com>)
libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 (Cosmin Truta <ctruta@...il.com>)
Linux KVM/x86 (tested on 6.1.74): guest-triggered host panic via SMM shadow MMU (Jinu Kim <kimjw04271234@...il.com>)
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration (Michael Straßberger <m.strassberger@...away…)
[NotCVE-2026-0016] game-music-emu VGM Command Interpreter Unvalidated 0xE0 PCM Seek Offset Allows Out-of-Bounds Read and Denial of Servic… (advisories@...cve.org)
[NotCVE-2026-0017] game-music-emu (libgme) 0.6.5 and Earlier AY Loader NULL Pointer Dereference Allows Denial of Service (advisories@...cve.org)
[NotCVE-2026-0018] game-music-emu (libgme) through 0.6.5 Unbounded GYM Command Loop Allows Heap Out-of-Bounds Read (advisories@...cve.org)
[NotCVE-2026-0019] game-music-emu through 0.6.5 VGM Command Interpreter Missing Operand Length Check Allows Heap Out-of-Bounds Read (advisories@...cve.org)
CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, t… (Shahar Epstein <shahar@...che.org>)
CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain (Shahar Epstein <shahar@...che.org>)
CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names (Shahar Epstein <shahar@...che.org>)
CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Da… (Shahar Epstein <shahar@...che.org>)
CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and incl… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker (Colm O hEigeartaigh <coheigea@...che.org>)
"several" CVEs in latest Debian linux security advisory DSA 6528-1 (Jan Schaumann <jschauma@...meister.org>)
CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71897: Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper … (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-71899: Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosu… (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-81569: Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin (Wenjun Ruan <wenjun@...che.org>)
CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to atta… (Jean-Baptiste Onofré <jbonofre@...che.…)
Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675 (Sam James <sam@...too.org>)
OpenSSL Security Advisory [29th September 2026] (Tomas Mraz <tomas@...nssl.foundation>)
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration (Alan Coopersmith <alan.coopersmith@...cle.co…)
Fwd: groff 1.24.2 released (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: "several" CVEs in latest Debian linux security advisory DSA 6528-1 (Zdenek Salvet <salvet@....muni.cz>)
CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification (Thomas Wolf <twolf@...che.org>)
CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server (Thomas Wolf <twolf@...che.org>)
CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server (Thomas Wolf <twolf@...che.org>)
CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read (Thomas Wolf <twolf@...che.org>)
CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies (Thomas Wolf <twolf@...che.org>)
CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension (Thomas Wolf <twolf@...che.org>)
CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective (Thomas Wolf <twolf@...che.org>)
CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap (Thomas Wolf <twolf@...che.org>)
CPython [CVE-2026-12345] Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the tempo… (Alan Coopersmith <alan.coopersmith@...c…)

September 30 (18 messages)

Branch Target Reuse: Practical Spectre-v2 Attacks in JIT Engines via Stale Branch Prediction Entries (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: JIT buffer overflow fixed in libpcre2-10.49 (Gabriel Ravier <gabravier@...il.com>)
Re: Moodle LMS 3.9.2: authenticated file-upload validation bypass (CWE-434) leading to RCE under misconfiguration (Daniel Ziegenberg <daniel.ziegenberg@...ien.…)
CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrad… (Christofer Dutz <cdutz@...che.org>)
CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser (Christofer Dutz <cdutz@...che.org>)
CVE-2026-102510: Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths (Christofer Dutz <cdutz@...che.org>)
CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them (Christofer Dutz <cdutz@...che.org>)
CVE-2026-85532: Apache WSS4J: Insufficient Validation of Derived-Key Parameters (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-89238: Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-92121: Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform r… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-92899: Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce (Colm O hEigeartaigh <coheigea@...che.org>)
CVE-2026-95616: Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificat… (Colm O hEigeartaigh <coheigea@...che.or…)
CVE-2026-80490: Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scala… (Robert Rothenberg <rrwo@...nsec.org>)
CPython [CVE-2026-19553] SSLContext.wrap_bio() missing validation of server_hostname parameter (Alan Coopersmith <alan.coopersmith@...cle.com>)
CPython [CVE-2026-19445] Use-after-free of a server-side SSLContext when sni_callback switches contexts (Alan Coopersmith <alan.coopersmith@...cle.com>)
Re: WebKitGTK and WPE WebKit Security Advisory WSA-2026-0006 (Adrian Perez de Castro <aperez@...lia.com>)

400 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.