oss-security mailing list - 2026/02

Follow @Openwall on Twitter for new release announcements and other news

[<prev month] [year] [list]

oss-security mailing list - 2026/02

Mon	Tue	Wed	Thu	Fri	Sat	Sun
						¹
² 3	³ 2	⁴ 1	⁵ 2	⁶	⁷ 2	⁸ 2
⁹ 8	¹⁰ 4	¹¹	¹² 2	¹³ 2	¹⁴	¹⁵
¹⁶	¹⁷	¹⁸	¹⁹	²⁰	²¹	²²
²³	²⁴	²⁵	²⁶	²⁷	²⁸

Messages by day:

February 2 (3 messages)

CVE-2026-23794: Apache Syncope: Reflected XSS on Enduser Login (Francesco Chicchiriccò <ilgrosso@...che.org>)
CVE-2026-23795: Apache Syncope: Console XXE on Keymaster parameters (Francesco Chicchiriccò <ilgrosso@...che.org>)
[kubernetes] Multiple issues in ingress-nginx (Tabitha Sable <tabitha.c.sable@...il.com>)

February 3 (2 messages)

Django CVE-2025-13473, CVE-2025-14550, CVE-2026-1207, CVE-2026-1285, CVE-2026-1287, and CVE-2026-1312 (Jacob Walls <jwalls@...ngoproject.com>)
Re: Systemd vsock sshd (Bastian Blank <bblank@...nkmo.de>)

February 4 (1 message)

CVE-2026-24735: Apache Answer: Revision API Improper Access Control leads to Information Disclosure (Enxin Xie <linkinstar@...che.org>)

February 5 (2 messages)

NGINX < 1.29.5, 1.28.2 MitM injection CVE-2026-1642 (Jan Schaumann <jschauma@...meister.org>)
[vim-security] buffer overflow in helpfile option handling affects Vim <9.1.2132 (Christian Brabandt <cb_home@....de>)

February 7 (2 messages)

On patch vs commit messages (Sam James <sam@...too.org>)
Go 1.25.7 and Go 1.24.13 are released with 2 CVE fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 8 (2 messages)

CVE-2026-23903: Apache Shiro: Auth bypass when accessing static files only on case-insensitive filesystems (Lenny Primak <lprimak@...che.org>)
CVE-2026-23901: Apache Shiro: Brute force attack possible to determine valid user names (Lenny Primak <lprimak@...che.org>)

February 9 (8 messages)

Re: On patch vs commit messages (Florian Weimer <fweimer@...hat.com>)
CVE-2026-22922: Apache Airflow: Airflow externalLogUrl Permission Bypass (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2026-24098: Apache Airflow: Assigning single DAG permission leaked all DAGs Import Errors (Ephraim Anierobi <ephraimanierobi@...che.org>)
CVE-2026-24343: Apache HertzBeat: Uncontrolled Resource Consumption via Crafted XPath Expressions (Qingran Zhao <zhaoqingran@...che.org>)
CVE-2026-23906: Apache Druid: Authentication Bypass via LDAP Anonymous Bind (Karan Kumar <karan@...che.org>)
gnutls 3.8.12 fixes CVE-2026-1584 & CVE-2025-14831 (Alan Coopersmith <alan.coopersmith@...cle.com>)
libpng 1.6.55: Heap buffer overflow vulnerability fixed: CVE-2026-25646 (Cosmin Truta <ctruta@...il.com>)
FreeRDP fixes 12 CVEs in 3.22.0 release (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 10 (4 messages)

Re: FreeRDP fixes 12 CVEs in 3.22.0 release (Solar Designer <solar@...nwall.com>)
PowerDNS Security Advisory 2026-01: Crafted zones can lead to increased resource usage in Recursor (Otto Moerbeek <otto.moerbeek@...erdns.com>)
CVE-2026-25506: MUNGE 0.5-0.5.17 buffer overflow allowing key leakage (Chris Dunlap <chris.m.dunlap@...il.com>)
PyCA cryptography 46.0.5 released with fix for CVE-2026-26007 (Alan Coopersmith <alan.coopersmith@...cle.com>)

February 12 (2 messages)

Pillow 12.1.1 released with fix for CVE-2026-25990 (Alan Coopersmith <alan.coopersmith@...cle.com>)
CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated code (Ryan Skraba <rskraba@...che.org>)

February 13 (2 messages)

CVE-2025-40905: WWW::OAuth 1.000 and earlier for Perl uses insecure rand() function for cryptographic functions (Alan Coopersmith <alan.coopersmith@...cle.com>)
[vim-security] NetBeans specialKeys Stack Buffer Overflow with Vim <9.1.2148 (Christian Brabandt <cb@...bit.org>)

28 messages

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.