oss-security mailing list
Recent messages:
- 2026/11/14 #2:
CVE-2026-129320: Apache Shiro: Principal tags in Jakarta Pages and
Jakarta Faces do not escape output, allowing cross-site sc… (Lenny Primak <lprimak@...che.org>)
- 2026/11/14 #1:
CVE-2026-114737: Apache Shiro: Incorrect default for
case-insensitive path matching in ShiroFilterFactoryBean allows auth
by… (Lenny Primak <lprimak@...che.org>)
- 2026/11/13 #11:
CVE-2026-124726: Apache APISIX: openapi-to-mcp tool call can reach
an API path the document does not declare (Abhishek Choudhary <shreemaanabhishek@...che.org…)
- 2026/11/13 #10:
CVE-2026-124723: Apache APISIX: unauthorized access to mTLS
protected resources (Abhishek Choudhary <shreemaanabhishek@...che.org>)
- 2026/11/13 #9:
CVE-2026-124719: Apache APISIX: identity spoofing in
openapi-to-mcp (Abhishek Choudhary <shreemaanabhishek@...che.org>)
- 2026/11/13 #8:
CVE-2026-124716: Apache APISIX: authz-keycloak authorization scope
mismatch (Abhishek Choudhary <shreemaanabhishek@...che.org>)
- 2026/11/13 #7:
CVE-2026-124680: Apache APISIX: Route-level authentication bypass
via path normalization mismatch between routing and u… (Abhishek Choudhary <shreemaanabhishek@a…)
- 2026/11/13 #6:
CVE-2026-124679: Apache APISIX: jwe-decrypt and forward-auth may
pass a client-supplied identity header (Abhishek Choudhary <shreemaanabhishek@...che.org>)
- 2026/11/13 #5:
CVE-2026-124666: Apache APISIX: Multi-auth preserves
client-supplied Wolf identity headers (Abhishek Choudhary <shreemaanabhishek@...che.org>)
- 2026/11/13 #4:
Dropbear: the restriction names an address — permitopen/permitlisten not enforced for unix-socket forwarding, docker.sock reachable (HEAD 99… (theknell@...k.com)
- 2026/11/13 #3:
CVE-2026-128239: GPAC/MP4Box: NULL Pointer Dereference in MPEG-4
Form Handlers via Crafted XMT Input ("Alexander A. Shvedov" <sigdevel@...amail.com>)
- 2026/11/13 #2:
CVE-2026-123338: Apache DataSketches C++: Out-of-bounds write in
REQ sketch deserialization allows memory corruption via a craft… (Lee Rhodes <leerho@...che.org>)
- 2026/11/13 #1:
CVE-2026-123274: Apache DataSketches C++: Out-of-bounds write in
KLL sketch deserialization allows memory corruption via a craft… (Lee Rhodes <leerho@...che.org>)
- 2026/11/12 #8:
Fw: New cabextract 1.12 and libmspack 0.12alpha release (Hanno Böck <hanno@...eck.de>)
- 2026/11/12 #7:
[vim-security] Command Execution via CSS Omni-Completion in Vim <
9.2.1342 (Christian Brabandt <cb@...bit.org>)
- 2026/11/12 #6:
CVE-2026-126641: ansible-pylibssh / ansible.netcommon libssh: changed
SSH host key accepted when host_key_auto_add is enabled (Ryo utomo <utomoryo395@...il.com>)
- 2026/11/12 #5:
dbus: multiple denial-of-service issues (Simon McVittie <smcv@...ian.org>)
- 2026/11/12 #4:
PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC
2 Released, fixes 52 security vulnerabilities (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/11/12 #3:
Apache TomEE: 38 CVEs addressed in 10.3.0 and 11.0.0-M2 (combined
announcement) (Markus Jung <jungm@...che.org>)
- 2026/11/12 #2:
CVE-2026-126673: Data::Dump::Streamer versions before 3.00 for Perl
allow code injection via unescaped Regexp patterns in … (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/11/12 #1:
CVE-2026-124023: Apache Axis2/C: Out-of-bounds read in the
Guththila XML reader wrapper (Robert Lazarski <robertlazarski@...che.org>)
- 2026/11/11 #29:
CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in
DecLibRecon::createSubPicRefBufs during Subpicture Reconstructi… ("Alexander A. Shvedov" <sigdevel@...ama…)
- 2026/11/11 #28:
CVE-2026-124309: VVdeC/vvdecapp: Heap Out-of-Bounds Read in
HRD::setBufferingPeriodSEI via Scalable-Nesting SEI ("Alexander A. Shvedov" <sigdevel@...amail.com>)
- 2026/11/11 #27:
CVE-2026-108472 - xfs_admin allows for OS command injection (Marco Benatto <mbenatto@...hat.com>)
- 2026/11/11 #26:
CVE-2026-93404: rsyslog 8.1901.0 through pre-2026-11-11 daily stable
omclickhouse SQL injection (Rainer Gerhards <rgerhards@...scon.com>)
- 2026/11/11 #25:
Re: Node.js security release pre-alert (Antoine du Hamel <duhamelantoine1995@...il.com>)
- 2026/11/11 #24:
CVE-2026-124310: VVdeC/vvdecapp: Out-of-Bounds Read in
Slice::getRefPic via Overlapping Slice CTU Coverage ("Alexander A. Shvedov" <sigdevel@...amail.com>)
- 2026/11/11 #23:
CVE-2026-124312: VVdeC/vvdecapp: Heap Out-of-Bounds Read in
CodingStructure::getColInfo with a Smaller Collocated Pictu… ("Alexander A. Shvedov" <sigdevel@...ama…)
- 2026/11/11 #22:
CVE-2026-123765: Apache Sling XSS: SLING-13406 (Joerg Hoh <joerghoh@...che.org>)
- 2026/11/11 #21:
CVE-2026-89326: Apache XML Graphics Batik: Check url protocol when
loading document (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #20:
CVE-2026-90993: Apache XML Graphics Batik: Harden validation in
SAXDocumentFactory (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #19:
CVE-2026-71395: Apache XML Graphics FOP: CWE-502 unsafe
deserialization in hyphenation loading (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #18:
CVE-2026-49236: Apache XML Graphics Batik: SVG color-profile
xml:base bypasses Batik external resource same-origin checks (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #17:
CVE-2026-44929: SSRF Vulnerability in Apache Batik (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #16:
CVE-2026-40853: Apache XML Graphics Batik: Cross-Site Scripting
via Unencoded Font Metadata in Apache Batik SVGFont (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #15:
CVE-2026-126627: Apache XML Graphics FOP: TemporaryFolder on
unix-like systems does not limitaccess to created files (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #14:
CVE-2026-111792: Apache XML Graphics Batik: Denial of Service via
SVG Element Reference Resolution (Simon Steiner <ssteiner@...che.org>)
- 2026/11/11 #13:
CVE-2026-119618: Apache HTTP Server: mod_http2: heap corruption
and RCE in assign_headers (Eric Covener <covener@...che.org>)
- 2026/11/11 #12:
CVE-2026-109163: Apache HTTP Server: mod_vhost_alias 1 byte stack
buffer overwrite (after CVE-2026-63292) (Eric Covener <covener@...che.org>)
- 2026/11/11 #11:
CVE-2026-106023: Apache HTTP Server: mod_md NULL pointer
dereference leads to child process crash (Eric Covener <covener@...che.org>)
- 2026/11/11 #10:
git: v2.56.1 and older maintenance release fixes for six
vulnerabilitie (Johannes Schindelin <Johannes.Schindelin@....de>)
- 2026/11/11 #9:
CVE-2026-123747 pappl-retrofit: Directory traversal in the
add-ppdfiles and delete-ppdfiles actions (Zdenek Dohnal <zdohnal@...hat.com>)
- 2026/11/11 #8:
The GNU C Library security advisories update for 2026-11-11 (Adhemerval Zanella Netto <adhemerval.zanella@...aro.org>)
- 2026/11/11 #7:
Emacs .dir-locals.el arbitrary code execution (Sean Whitton <spwhitton@...hitton.name>)
- 2026/11/11 #6:
Apache Roller: 15 CVEs fixed in 6.1.7 (Dave <snoopdave@...il.com>)
- 2026/11/11 #5:
CVE-2026-124496: Apache Storm: DRPC HTTP doAsUser bypasses the
impersonation authorizer (Rui Abreu <rabreu@...che.org>)
- 2026/11/11 #4:
CVE-2026-124495: Apache Storm: Logviewer follows worker symlinks
across topology ACLs (Rui Abreu <rabreu@...che.org>)
- 2026/11/11 #3:
CVE-2026-94125: Apache Storm: Supervisor page discloses worker
placement of other users' topologies (Rui Abreu <rabreu@...che.org>)
- 2026/11/11 #2:
Re: Xen Security Advisory 525 v1
(CVE-2024-36350,CVE-2024-36357,CVE-2026-0004) - x86: Transient Scheduler
Attacks (upd… (Andrew Cooper <andrew.cooper3@...rix.co…)
- 2026/11/11 #1:
Plone security fix 20261110: remote code execution (Maurits van Rees <maurits@...rees.org>)
- 2026/11/10 #31:
CPython: [CVE-2026-115559] imaplib STARTTLS serves
plaintext bytes buffered before the handshake as if they came over T… (Alan Coopersmith <alan.coopersmith@...c…)
- 2026/11/10 #30:
CPython: [CVE-2026-115791] Prevent shadowing stdlib in
gzip/tarfile/zipfile CLI (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/11/10 #29:
CVE-2026-122096: Apache DataSketches Java: Uncontrolled resource
consumption when deserializing crafted sketch images (Lee Rhodes <leerho@...che.org>)
- 2026/11/10 #28:
Go 1.27.4 and Go 1.26.11 are released with 12 security
fixes (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/11/10 #27:
Re: [Coordinated disclosure] sblim-sfcb: pre-auth
remote DoS (and latent OOB NUL write) via unbounded quoted-attribute sc… (Eun0us / Espilon <eun0us@...ilon.net>)
- 2026/11/10 #26:
Xen Security Advisory 532 v1 (CVE-2026-99287) - Linux
xen-netback: guest can trigger double unmap of memory (Xen.org security team <security@....org>)
- 2026/11/10 #25:
Xen Security Advisory 531 v1 (CVE-2026-99286) - Linux
xen-netback: guest can trigger use-after-free for network statist… (Xen.org security team <security@....org…)
- 2026/11/10 #24:
Xen Security Advisory 530 v2 (CVE-2026-102706,CVE-2026-102707,CVE-2026-102708,CVE-2026-119779,CVE-2026-119780)
- XAPI: … (Xen.org security team <security@....org…)
- 2026/11/10 #23:
Xen Security Advisory 529 v2 (CVE-2026-102705) - XAPI:
data-dependent compare function used for Pool Secret (Xen.org security team <security@....org>)
- 2026/11/10 #22:
Xen Security Advisory 525 v1 (CVE-2024-36350,CVE-2024-36357,CVE-2026-0004)
- x86: Transient Scheduler Attacks (update) (Xen.org security team <security@....org…)
- 2026/11/10 #21:
Xen Security Advisory 524 v1 (CVE-2024-21963) - AMD IOMMU
Out-of-Bounds Device Table Read (Xen.org security team <security@....org>)
- 2026/11/10 #20:
sqlparse 0.6.1 fixes two vulnerabilities, announces
EOL (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/11/10 #19:
Re: LLMs and embargoes (was: Home Assistant: the password is not...) (Jeremy Stanley <fungi@...goth.org>)
- 2026/11/10 #18:
Re: [Coordinated disclosure] sblim-sfcb: pre-auth
remote DoS (and latent OOB NUL write) via unbounded quoted-attribute scan in
CIM-XML parser (… (h <h@...er.ee>)
- 2026/11/10 #17:
CVE-2026-120212: Web::Simple versions before 0.037 for Perl do not
escape single quotes in HTML::Tags output (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/11/10 #16:
CVE-2026-125729: Plack::Middleware::CSP versions before 0.03 for Perl
send the Content Security Policy under the wrong hea… (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/11/10 #15:
CVE-2026-124308: VVdeC/vvdecapp: Heap Use-After-Free in
DecLibRecon::createSubPicRefBufs after Aborted Picture Decoding ("Alexander A. Shvedov" <sigdevel@...ama…)
- 2026/11/10 #14:
OT - PHP2shell - how did we do five years after Log2j? ("Olle E. Johansson" <oej@...ina.net>)
- 2026/11/10 #13:
Fwd: X.Org Security Advisory: multiple security issues in X.Org X server (Olivier Fourdan <ofourdan@...hat.com>)
- 2026/11/10 #12:
OpenSSL: 5 Low fixes merged, QUIC, AES-GCM-SIV and CMS (Norbert Pócs <norbertp@...nssl.org>)
- 2026/11/10 #11:
Re: Rooting ISPs and Hosting Providers with Hyperglass (theknell@...k.com)
- 2026/11/10 #10:
Re: [Coordinated disclosure] sblim-sfcb: pre-auth
remote DoS (and latent OOB NUL write) via unbounded quoted-attribute … (Alan Coopersmith <alan.coopersmith@...c…)
- 2026/11/10 #9:
[Coordinated disclosure] sblim-sfcb: pre-auth remote DoS (and latent
OOB NUL write) via unbounded quoted-attribute scan i… (Eun0us / Espilon <eun0us@...ilon.net>)
- 2026/11/10 #8:
Re: Rooting ISPs and Hosting Providers with Hyperglass (Solar Designer <solar@...nwall.com>)
- 2026/11/10 #7:
Rooting ISPs and Hosting Providers with Hyperglass (factoid@...ke.ru)
- 2026/11/10 #6:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password c… ("Gregory Mullen" <oss-security@...ht>)
- 2026/11/10 #5:
"Malicious" public disclosure is a lot better than other ways of misusing 0-days (Was: Home Assistant: the password is not… (Aaron Rainbolt <arraybolt3@...il.com>)
- 2026/11/10 #4:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (… (theknell@...k.com)
- 2026/11/10 #3:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password cha… (Solar Designer <solar@...nwall.com>)
- 2026/11/10 #2:
Dokploy: the validator allows the backtick — a member's database password change is host RCE, 9.9 on the vendor's own vector (v0.31.0, live-… (theknell@...k.com)
- 2026/11/10 #1:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (… (theknell@...k.com)
- 2026/11/09 #38:
krb5-1.22.3 is released, with fixes for 21 CVEs (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/11/09 #37:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password c… ("Gregory Mullen" <oss-security@...ht>)
- 2026/11/09 #36:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password… (Kevin Riggle <kevinr@...plexsystems.gro…)
- 2026/11/09 #35:
Re: Home Assistant: the password is not the key
—
token secrets in cleartext, two token classes never expire, password
… (Brian May <brian@...uxpenguins.xyz>)
- 2026/11/09 #34:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password c… ("Gregory Mullen" <oss-security@...ht>)
- 2026/11/09 #33:
Re: Home Assistant: the password is not the key
— token secrets in cleartext, two token classes never
expire, password change … (Sam Bull <9m199i@...bull.org>)
- 2026/11/09 #32:
CVE-2026-115864: Monoceros versions before 0.30 for Perl allow a
request declaring a large Content-Length to kill a worker… (Robert Rothenberg <rrwo@...nsec.org>)
- 2026/11/09 #31:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password change revokes none (… (theknell@...k.com)
- 2026/11/09 #30:
CVE-2026-124077: Apache Commons Codec: NUL bytes in tree entry
names cause Git/SWHID identifier collisions (GitIdentifi… ("Gary D. Gregory" <ggregory@...che.org>)
- 2026/11/09 #29:
CVE-2026-119078: Apache Commons Codec: Blake3 doFinalize is
stateless; the documented KDF example derives identical key… ("Gary D. Gregory" <ggregory@...che.org>)
- 2026/11/09 #28:
Re: [musl] Re: "sshole": password authentication
bypass: OpenSSH + musl libc (Rich Felker <dalias@...c.org>)
- 2026/11/09 #27:
Re: “sshole”: password authentication bypass: OpenSSH + musl libc (Vidya Murthy <vidya@...crypt.com>)
- 2026/11/09 #26:
Re: "sshole": password authentication bypass: OpenSSH
+ musl libc (Loganaden Velvindron <loganaden@...il.com>)
- 2026/11/09 #25:
CPython: [CVE-2026-19552]
ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never
the identity (Alan Coopersmith <alan.coopersmith@...cle.…)
- 2026/11/09 #24:
CPython: [CVE-2026-124249] http.cookiejar deletes
cookies of other domains via expired Set-Cookie (Alan Coopersmith <alan.coopersmith@...cle.com>)
- 2026/11/09 #23:
Re: Home Assistant: the password is not the key — token secrets in cleartext, two token classes never expire, password… (Kevin Riggle <kevinr@...plexsystems.gro…)
- 2026/11/09 #22:
CVE-2026-124311: VVdeC/vvdecapp: NULL Pointer Dereference in
InterPrediction::xPredInterBlk via Reference Wrap-Around ("Alexander A. Shvedov" <sigdevel@...amai…)
- 2026/11/09 #21:
CVE-2026-124307: VVdeC/vvdecapp: Heap Use-After-Free in
AdaptiveLoopFilter::reconstructCoeff via ALF APS Redefinition ("Alexander A. Shvedov" <sigdevel@...amai…)
- 2026/11/09 #20:
CVE-2026-113508: Apache Airflow: Logout token revocation fails
open; errors silently swallowed (Rahul Vats <rahulvats@...che.org>)
35178 messages
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
