Products Openwall GNU/*/Linux   server OS Linux Kernel Runtime Guard John the Ripper   password cracker Free & Open Source for any platform in the cloud Pro for Linux Pro for macOS Wordlists   for password cracking passwdqc   policy enforcement Free & Open Source for Unix Pro for Windows (Active Directory) yescrypt   KDF & password hashing yespower   Proof-of-Work (PoW) crypt_blowfish   password hashing phpass   ditto in PHP tcb   better password shadowing Pluggable Authentication Modules scanlogd   port scan detector popa3d   tiny POP3 daemon blists   web interface to mailing lists msulogin   single user mode login php_mt_seed   mt_rand() cracker Services Publications Articles Presentations Resources Mailing lists Community wiki Source code repositories (GitHub) File archive & mirrors How to verify digital signatures OVE IDs What's new

oss-security mailing list - 2026/11/10

• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (… (theknell@...k.com)
• Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-… (theknell@...k.com)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password cha… (Solar Designer <solar@...nwall.com>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (… (theknell@...k.com)
• "Malicious" public disclosure is a lot better than other ways of misusing 0-days (Was: Home Assistant: the password is not… (Aaron Rainbolt <arraybolt3@...il.com>)
• Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password c… ("Gregory Mullen" <oss-security@...ht>)
• Rooting ISPs and Hosting Providers with Hyperglass (factoid@...ke.ru)
• Re: Rooting ISPs and Hosting Providers with Hyperglass (Solar Designer <solar@...nwall.com>)
• [Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent OOB NUL write) via unbounded quoted-attribute scan i… (Eun0us / Espilon <eun0us@...ilon.net>)
• Re: [Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent OOB NUL write) via unbounded quoted-attribute … (Alan Coopersmith <alan.coopersmith@...c…)
• Re: Rooting ISPs and Hosting Providers with Hyperglass (theknell@...k.com)
• OpenSSL: 5 Low fixes merged, QUIC, AES-GCM-SIV and CMS (Norbert Pócs <norbertp@...nssl.org>)
• Fwd: X.Org Security Advisory: multiple security issues in X.Org X server (Olivier Fourdan <ofourdan@...hat.com>)
• OT - PHP2shell - how did we do five years after Log2j? ("Olle E. Johansson" <oej@...ina.net>)
• CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in DecLibRecon::createSubPicRefBufs after Aborted Picture Decoding ("Alexander A. Shvedov" <sigdevel@...ama…)
• CVE-2026-125729: Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong hea… (Robert Rothenberg <rrwo@...nsec.org>)
• CVE-2026-120212: Web::Simple versions before 0.037 for Perl do not escape single quotes in HTML::Tags output (Robert Rothenberg <rrwo@...nsec.org>)
• Re: [Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent OOB NUL write) via unbounded quoted-attribute scan in CIM-XML parser (… (h <h@...er.ee>)
• Re: LLMs and embargoes (was: Home Assistant: the password is not...) (Jeremy Stanley <fungi@...goth.org>)
• sqlparse 0.6.1 fixes two vulnerabilities, announces EOL (Alan Coopersmith <alan.coopersmith@...cle.com>)
• Xen Security Advisory 524 v1 (CVE-2024-21963) - AMD IOMMU Out-of-Bounds Device Table Read (Xen.org security team <security@....org>)
• Xen Security Advisory 525 v1 (CVE-2024-36350,CVE-2024-36357,CVE-2026-0004) - x86: Transient Scheduler Attacks (update) (Xen.org security team <security@....org…)
• Xen Security Advisory 529 v2 (CVE-2026-102705) - XAPI: data-dependent compare function used for Pool Secret (Xen.org security team <security@....org>)
• Xen Security Advisory 530 v2 (CVE-2026-102706,CVE-2026-102707,CVE-2026-102708,CVE-2026-119779,CVE-2026-119780) - XAPI: … (Xen.org security team <security@....org…)
• Xen Security Advisory 531 v1 (CVE-2026-99286) - Linux xen-netback: guest can trigger use-after-free for network statist… (Xen.org security team <security@....org…)
• Xen Security Advisory 532 v1 (CVE-2026-99287) - Linux xen-netback: guest can trigger double unmap of memory (Xen.org security team <security@....org>)
• Re: [Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent OOB NUL write) via unbounded quoted-attribute sc… (Eun0us / Espilon <eun0us@...ilon.net>)
• Go 1.27.4 and Go 1.26.11 are released with 12 security fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
• CVE-2026-122096: Apache DataSketches Java: Uncontrolled resource consumption when deserializing crafted sketch images (Lee Rhodes <leerho@...che.org>)
• CPython: [CVE-2026-115791] Prevent shadowing stdlib in gzip/tarfile/zipfile CLI (Alan Coopersmith <alan.coopersmith@...cle.com>)
• CPython: [CVE-2026-115559] imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over T… (Alan Coopersmith <alan.coopersmith@...c…)

31 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.