Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
oss-security contributors propose digests or a separate list to manage a flood of AI vulnerability reports.
24
- Mentions · 7d0
- Mentions · 30d1
- All mentions11
- First seenSep 8, 2026
- Last mentioned24d ago
Timeline
11 articles · newest firstFilter, reshape, and redact logs before export with Transformers
Cloudflare Logpush Transformers, now generally available, filter, redact, and reshape logs with SQL before export.
28
CISA Warns of Apache Struts Command Injection Vulnerability Exploited in Attacks
CISA added exploited Apache Struts command injection flaw CVE-2016-3081 to its KEV catalog with forensic triage required.
75
CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective
CVE-2026-94052 (CVSS 9.1) lets unauthenticated attackers bypass LDAP password authentication in Apache MINA SSHD sshd-ldap.
58
CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension
CVE-2026-94029 (CVSS 6.5) allows low-privileged users to exhaust server memory via Apache MINA SSHD SFTP v6 extensions.
35
The Truth about GET and HTTP Standards, (Tue, Sep 22nd)
SANS research tests Apache, NGINX, and Python server responses to non-standard HTTP GET requests with a body, finding inconsistent handling.
20
CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
Apache Airflow logout fails to revoke bearer tokens, leaving them valid until expiry.
28
CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation
Apache Airflow lets a session cookie override a bearer token, enabling session fixation.
30
RAFT: A Stateful Retrieval-Augmented Framework for Troubleshooting Agents
Researchers introduce RAFT, a stateful retrieval-augmented framework that retrieves timeline entries from historical cases to improve enterprise troubleshooting agents.
28
Apache Superset SQL Injection Flaw Gets Public PoC Exploit
A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.
52
CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider flaw (CVE-2026-75156) lets attackers bypass Azure AD OAuth token validation via unvalidated issuer and audience claims.
45
Related CVEs
by mentions- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- Logout Fails to Revoke Bearer Tokens in Apache Airflow (CWE-613)
- CVE-2026-75156<1%9.1Cross-tenant authentication bypass in Apache Airflow FAB provider
- Authentication Bypass via LdapPasswordAuthenticator in Apache MINA SSHD
- Memory exhaustion in Apache MINA SSHD SFTP check-file
- CVE-2026-23980<1%5.3Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read…
- Session Cookie Overrides Bearer Token in Apache Airflow 3.3.0–3.3.1
Appears with
- Apachevendor · 5
- Apache Airflowproduct · 3
- Apache MINA SSHDorganization · 2
- Microsoftorganization · 1
- Cloudflarevendor · 1
- SANS Internet Storm Centervendor · 1
- Transformersproduct · 1
- GraphRAGproduct · 1
- Apache Arrowproduct · 1
- Microsoftvendor · 1
- Apache DataFusionproduct · 1
- Apache Supersetproduct · 1
- NGINXproduct · 1
- NGINXvendor · 1
- Cloudflareorganization · 1
- Apacheproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.