oss-security mailing list
Recent messages:
- 2026/04/01 #3:
Re: Multiple vulnerabilities in AppArmor (Greg KH <greg@...ah.com>)
- 2026/04/01 #2:
Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
- 2026/04/01 #1:
Re: [vim-security] Vim modeline bypass via various
options affects Vim < 9.2.0276 (Salvatore Bonaccorso <carnil@...ian.org>)
- 2026/03/31 #15:
[ADVISORY] CVE-2026-34956: Open vSwitch: Invalid memory access in
conntrack FTP alg. (Aaron Conole <aconole@...hat.com>)
- 2026/03/31 #14:
[vim-security] Vim modeline bypass via various options affects Vim <
9.2.0276 (Christian Brabandt <cb@...bit.org>)
- 2026/03/31 #13:
Fwd: XZ Utils 5.8.3 and a security fix (Sam James <sam@...too.org>)
- 2026/03/31 #12:
Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272 ("David A. Wheeler" <dwheeler@...eeler.com>)
- 2026/03/31 #11:
Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
- 2026/03/31 #10:
Fwd: CVE-2026-5087: PAGI::Middleware::Session::Store::Cookie versions
through 0.001003 for Perl generates random bytes ins… (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/03/31 #9:
CVE-2024-14030: Sereal::Decoder versions from 4.000 through 4.009_002
for Perl is vulnerable to a buffer overwrite flaw in… (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/03/31 #8:
CVE-2024-14031: Sereal::Encoder versions from 4.000 through 4.009_002
for Perl is vulnerable to a buffer overwrite flaw in… (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/03/31 #7:
CVE-2025-15618: Business::OnlinePayment::StoredTransaction versions
through 0.01 for Perl uses an insecure secret key (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/03/31 #6:
Axios Supply-Chain Attack [v1.14.1] [0.30.4] --> plain-crypto-js
[4.2.0][4.2.1] (Michael Straßberger <m.strassberger@...aways.de>)
- 2026/03/31 #5:
Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272 (Tianyu Chen <sweetyfish@...pin.org>)
- 2026/03/31 #4:
Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
- 2026/03/31 #3:
PowerDNS Security Advisory 2026-02 for DNSdist: Multiple issues (Remi Gacogne <remi.gacogne@...erdns.com>)
- 2026/03/31 #2:
Re: Multiple vulnerabilities in AppArmor (John Johansen <john.johansen@...onical.com>)
- 2026/03/31 #1:
Re: KVM shadow EPT stale rmap use-after-free (Solar Designer <solar@...nwall.com>)
- 2026/03/30 #9:
CVE-2026-32794: Apache Airflow Provider for Databricks: TLS
Certificate Verification Disabled in Databricks Provider K8s T… (Jens Scheffler <jscheffl@...che.org>)
- 2026/03/30 #8:
pyca/cryptography: CVE-2026-34073: X.509: bypass of
name constraints on wildcard SANs with matching peer names (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/30 #7:
The GNU C Library security advisory update for 2026-03-30 (Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>)
- 2026/03/30 #6:
Re: KVM shadow EPT stale rmap use-after-free (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/03/30 #5:
KVM shadow EPT stale rmap use-after-free (Sandipan Roy <saroy@...hat.com>)
- 2026/03/30 #4:
Re: [vim-security] Vim tabpanel modeline escape
affects Vim < 9.2.0272 (Demi Marie Obenour <demiobenour@...il.com>)
- 2026/03/30 #3:
[vim-security] Vim tabpanel modeline escape affects Vim < 9.2.0272 (Christian Brabandt <cb@...bit.org>)
- 2026/03/30 #2:
Re: CVE-2026-4176: Perl versions from 5.9.4 before
5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 co… (Jacob Bachmeyer <jcb62281@...il.com>)
- 2026/03/30 #1:
CVE-2026-4176: Perl versions from 5.9.4 before 5.40.4-RC1, from
5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vul… (Stig Palmquist <stig@...g.io>)
- 2026/03/29 #2:
[CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability (cyber security <cs7778503@...il.com>)
- 2026/03/29 #1:
Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
- 2026/03/28 #6:
Re: Multiple vulnerabilities in AppArmor (John Johansen <john.johansen@...onical.com>)
- 2026/03/28 #5:
CVE-2026-3256: HTTP::Session versions through 0.53 for Perl defaults
to using insecurely generated session ids (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/03/28 #4:
CVE-2025-15604: Amon2 versions before 6.17 for Perl use an insecure
random_string implementation for security functions (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/03/28 #3:
Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
- 2026/03/28 #2:
Re: [ADVISORY] SQUID-2026:1 Denial of Service in ICP Request handling (CVE-2026-33526) (Solar Designer <solar@...nwall.com>)
- 2026/03/28 #1:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0002 (Adrian Perez de Castro <aperez@...lia.com>)
- 2026/03/27 #5:
Re: Re: Multiple vulnerabilities in AppArmor (kf503bla@...k.com)
- 2026/03/27 #4:
Re: Multiple vulnerabilities in AppArmor (Qualys Security Advisory <qsa@...lys.com>)
- 2026/03/27 #3:
CVE-2026-1961: Foreman: Remote Code Execution via command injection
in WebSocket proxy (Ondrej Gajdusek <ogajduse@...hat.com>)
- 2026/03/27 #2:
Dovecot Security Advisory OXDC-2026-0001 (Aki Tuomi <aki.tuomi@...ecot.fi>)
- 2026/03/27 #1:
Re: Multiple vulnerabilities in AppArmor (Greg KH <gregkh@...uxfoundation.org>)
- 2026/03/26 #7:
TigerVNC 1.16.2 security release (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/26 #6:
CVE-2026-4851: remote-to-local code execution in GRID::Machine (piedcrow@...eup.net)
- 2026/03/26 #5:
Re: Multiple vulnerabilities in AppArmor (Qualys Security Advisory <qsa@...lys.com>)
- 2026/03/26 #4:
Re: Xen Security Advisory 482 v2 - Linux privcmd
driver can circumvent kernel lockdown (Juergen Gross <jgross@...e.com>)
- 2026/03/26 #3:
7 CVEs fixed in nginx (Solar Designer <solar@...nwall.com>)
- 2026/03/26 #2:
CVE-2014-125112: Plack::Middleware::Session::Cookie versions through
0.21 for Perl allows remote code execution (Timothy Legge <timlegge@...nsec.org>)
- 2026/03/26 #1:
libpng 1.6.56: Two high-severity vulnerabilities fixed:
CVE-2026-33416, CVE-2026-33636 (Cosmin Truta <ctruta@...il.com>)
- 2026/03/25 #8:
Re: CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety
vulnerabilities (use-after-free, NULL deref) (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
- 2026/03/25 #7:
ISC has disclosed four vulnerabilities in BIND 9 (CVE-2026-1519,
CVE-2026-3104, CVE-2026-3119, CVE-2026-3591) (Nicki Křížek <nicki@....org>)
- 2026/03/25 #6:
ISC has disclosed one vulnerability in Kea (CVE-2026-3608) (Peter Davies <peterd@....org>)
- 2026/03/25 #5:
backdoor in litellm version 1.82.7 (Jan Schaumann <jschauma@...meister.org>)
- 2026/03/25 #4:
[ADVISORY] SQUID-2026:3 Out of Bounds Read in ICP message handling
(CVE-2026-33515) (Amos Jeffries <squid3@...enet.co.nz>)
- 2026/03/25 #3:
[ADVISORY] SQUID-2026:2 Denial of Service in ICP Request handling
(CVE-2026-32748) (Amos Jeffries <squid3@...enet.co.nz>)
- 2026/03/25 #2:
[ADVISORY] SQUID-2026:1 Denial of Service in ICP Request handling
(CVE-2026-33526) (Amos Jeffries <squid3@...enet.co.nz>)
- 2026/03/25 #1:
NodeJS Security Releases fixes High, 5 Medium, 2 Low
severity issues (Jan Schaumann <jschauma@...meister.org>)
- 2026/03/24 #6:
litellm pypi packages compromised, infostealer added (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/24 #5:
Re: Xen Security Advisory 482 v2 - Linux privcmd
driver can circumvent kernel lockdown (Andrew Cooper <andrew.cooper3@...rix.com>)
- 2026/03/24 #4:
Re: Xen Security Advisory 482 v2 - Linux privcmd
driver can circumvent kernel lockdown (Greg KH <greg@...ah.com>)
- 2026/03/24 #3:
Xen Security Advisory 482 v3 (CVE-2026-31788) - Linux privcmd
driver can circumvent kernel lockdown (Xen.org security team <security@....org>)
- 2026/03/24 #2:
Re: Xen Security Advisory 482 v2 - Linux privcmd
driver can circumvent kernel lockdown (Greg KH <greg@...ah.com>)
- 2026/03/24 #1:
Xen Security Advisory 482 v2 - Linux privcmd driver can
circumvent kernel lockdown (Xen.org security team <security@....org>)
- 2026/03/23 #2:
The GNU C Library security advisories update for 2026-03-23 (Carlos O'Donell <carlos@...hat.com>)
- 2026/03/23 #1:
Re: Trivy github actions repo compromised, infostealer added (Jeremy Utiera <jeremyutiera@...il.com>)
- 2026/03/22 #3:
Re: CVE-2006-10002: XML::Parser versions through 2.47
for Perl could overflow the pre-allocated buffer size cause a hea… (Salvatore Bonaccorso <carnil@...ian.org…)
- 2026/03/22 #2:
Re: Buffer overflow in /bin/su from UNIX v4 (Peter Gutmann <pgut001@...auckland.ac.nz>)
- 2026/03/22 #1:
Re: Buffer overflow in /bin/su from UNIX v4 (Steffen Nurpmeso <steffen@...oden.eu>)
- 2026/03/21 #7:
Re: Buffer overflow in /bin/su from UNIX v4 (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/21 #6:
Re: Buffer overflow in /bin/su from UNIX v4 (Justin Swartz <justin.swartz@...ingedge.co.za>)
- 2026/03/21 #5:
Re: Buffer overflow in /bin/su from UNIX v4 (Solar Designer <solar@...nwall.com>)
- 2026/03/21 #4:
Re: Buffer overflow in /bin/su from UNIX v4 (kf503bla@...k.com)
- 2026/03/21 #3:
Re: pyOpenSSL 26.0.0 released with two CVE fixes (Alex Gaynor <alex.gaynor@...il.com>)
- 2026/03/21 #2:
CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety
vulnerabilities (use-after-free, NULL deref) (Abhinav Agarwal <abhinavagarwal1996@...il.com>)
- 2026/03/21 #1:
Trivy github actions repo compromised, infostealer
added (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/20 #6:
Re: Buffer overflow in /bin/su from UNIX v4 (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/20 #5:
pyOpenSSL 26.0.0 released with two CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/20 #4:
[CVE-2026-30922] Denial of Service in pyasn1 via
Unbounded Recursion (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/20 #3:
nghttp2 Denial of service: Assertion failure due to
the missing state validation (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/20 #2:
CVE-2026-32642: Apache Artemis, Apache ActiveMQ Artemis: Temporary
address auto-created for OpenWire consumer without crea… (Justin Bertram <jbertram@...che.org>)
- 2026/03/20 #1:
Fwd: [CPython][CVE-2026-4519] webbrowser.open() API
allows leading dashes (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/03/19 #10:
[vim-security]: Command injection via newline in glob() affects Vim
< 9.2.0202 (Christian Brabandt <cb@...bit.org>)
- 2026/03/19 #9:
[kubernetes] CVE-2026-4342: ingress-nginx comment-based nginx
configuration injection (Tabitha Sable <tabitha.c.sable@...il.com>)
- 2026/03/19 #8:
Re: Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
- 2026/03/19 #7:
Re: Off-by-one heap buffer overflow in libuv (Stuart Henderson <stu@...cehopper.org>)
- 2026/03/19 #6:
Re: Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
- 2026/03/19 #5:
Re: Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
- 2026/03/19 #4:
Off-by-one heap buffer overflow in libuv (Ali Raza <elirazamumtaz@...il.com>)
- 2026/03/19 #3:
[OSSA-2026-004] Glance: Server-Side Request Forgery (SSRF)
vulnerabilities in OpenStack Glance image import functionali… (Brian Rosmaita <rosmaita.fossdev@...il.…)
- 2026/03/19 #2:
CVE-2006-10003: XML::Parser versions through 2.47 for Perl has an
off-by-one heap buffer overflow in st_serial_stack (Timothy Legge <timlegge@...nsec.org>)
- 2026/03/19 #1:
CVE-2006-10002: XML::Parser versions through 2.47 for Perl could
overflow the pre-allocated buffer size cause a heap corru… (Timothy Legge <timlegge@...nsec.org>)
- 2026/03/18 #12:
CVE-2026-31973: samtools <= 1.23 NULL pointer dereference in
cram-size (Robert Davies <rmd@...ger.ac.uk>)
- 2026/03/18 #11:
CVE-2026-31972: samtools <= 1.21 Use-after-free in mpileup leading
to an invalid read (Robert Davies <rmd@...ger.ac.uk>)
- 2026/03/18 #10:
HTSlib <= 1.23 Multiple vulnerabilities in the CRAM file reader (Robert Davies <rmd@...ger.ac.uk>)
- 2026/03/18 #9:
CVE-2026-31970: HTSlib <= 1.23 heap buffer overflow in the BGZF
index file reader (Robert Davies <rmd@...ger.ac.uk>)
- 2026/03/18 #8:
WebKitGTK and WPE WebKit Security Advisory WSA-2026-0001 (Adrian Perez de Castro <aperez@...lia.com>)
- 2026/03/18 #7:
Re: OpenSSH GSSAPI keyex patch issue (Jeffrey Walton <noloader@...il.com>)
- 2026/03/18 #6:
Multiple vulnerabilities in Jenkins and Jenkins plugins (Daniel Beck <ml@...kweb.net>)
- 2026/03/18 #5:
Re: OpenSSH GSSAPI keyex patch issue (Dmitry Belyavskiy <dbelyavs@...hat.com>)
- 2026/03/18 #4:
Re: OpenSSH GSSAPI keyex patch issue (Solar Designer <solar@...nwall.com>)
- 2026/03/18 #3:
[SBA-ADV-20251205-01] LibreChat 0.8.1-rc2 RAG API Authentication
Bypass (SBA Research Security Advisory <advisory@...-research.org>)
- 2026/03/18 #2:
Re: OpenSSH GSSAPI keyex patch issue (Dmitry Belyavskiy <dbelyavs@...hat.com>)
32304 messages
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
