GNU

Search everything

Mentions · 7d2
Mentions · 30d7
All mentions17
First seenSep 10, 2026
Last mentioned11h ago

Timeline

17 articles · newest first

glibc gettext allows directory traversal via LANGUAGE

The issue affects GNU C Library 2.0 and later, except setuid or setgid programs marked AT_SECURE.

oss-securityOct 30, 18:43 UTC · 11h agoVulnerability

GNU patch 2.8.1 released, fixing CVE-2026-115207

An oss-security note points to a GNU announcement, but the feed snippet gives no flaw details.

oss-securityOct 26, 16:33 UTC · 4d agoVulnerabilityCVE-2026-115207

Re: Incomplete fix for Emacs CVE-2026-79992

Salvatore Bonaccorso flags CVE-2026-108976 as an incomplete fix for Emacs CVE-2026-79992.

oss-securityOct 15, 06:35 UTC · 15d agoVulnerabilityCVE-2026-79992 CVE-2026-1089763 · 1 read

Re: Incomplete fix for Emacs CVE-2026-79992

Maintainers say the Emacs fix for CVE-2026-79992 is incomplete and request another CVE.

oss-securityOct 14, 14:43 UTC · 16d agoVulnerabilityCVE-2026-799921

Incomplete fix for Emacs CVE-2026-79992

Researchers found Emacs CVE-2026-79992's fix incomplete because TRAMP still accepts dangerous username characters.

oss-securityOct 11, 15:15 UTC · 19d agoVulnerabilityCVE-2026-799922 · 1 read

3 Vulnerabilities in GNU Aspell before 0.60.8.3

GNU Aspell before 0.60.8.3 has three flaws, including CVE-2026-75818, per CERT Polska.

oss-securityOct 10, 00:08 UTC · 21d agoVulnerabilityCVE-2026-758183 · 1 read

Fwd: [Freeipmi-announce] FreeIPMI 1.6.20 Released

FreeIPMI 1.6.20 was announced and forwarded to oss-security without any included fix details.

oss-securityOct 5, 22:18 UTC · 25d agoVulnerability2

Dissecting House of Apple 2 on modern glibc

Walkthrough shows House of Apple 2 still hijacks glibc 2.43 file streams through an unchecked wide-character vtable.

Lobsters · securitySep 26, 19:31 UTC · Sep 26, 2026Research7 · 5 reads

Re: CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

Simon McVittie questions whether libextractor CVE-2026-100310 is a realistic setuid privilege escalation.

oss-securitySep 26, 17:34 UTC · Sep 26, 2026VulnerabilityCVE-2026-1003101 · 1 read

CVE-2026-95510: GNU Inetutils: use of uninitialized struct sigaction

GNU Inetutils CVE-2026-95510 uses an uninitialized sigaction in rlogin, rlogind, and telnetd, risking crashes.

oss-securitySep 26, 06:17 UTC · Sep 26, 2026VulnerabilityCVE-2026-955102

CVE-2026-100310: GNU libextractor < 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX

GNU libextractor before 1.16 can be locally escalated via the LIBEXTRACTOR_PREFIX search path.

oss-securitySep 25, 22:31 UTC · Sep 25, 2026VulnerabilityCVE-2026-100310

Re: GNU Emacs vulnerability upon opening arbitrary file

CVE-2026-96269 was assigned to a GNU Emacs flaw triggered by opening an arbitrary file.

oss-securitySep 23, 15:15 UTC · Sep 23, 2026Vulnerability 2 sourcesCVE-2026-962691 · 1 read

Re: Emacs arbitrary code execution: incomplete fix for CVE-2024-53920

CVE-2026-96442 was assigned for an incomplete Emacs fix of arbitrary code execution CVE-2024-53920.

oss-securitySep 23, 15:13 UTC · Sep 23, 2026Vulnerability 2 sourcesCVE-2026-96442 CVE-2024-539201 · 1 read

The GNU C Library security advisories update for 2026-09-22

A glibc ld.so TOCTOU lets local attackers load code via $ORIGIN in setuid programs.

oss-securitySep 22, 16:56 UTC · Sep 22, 2026Vulnerability2

The GNU C Library security advisories update for 2026-09-17

GNU C Library advisory describes a DNS stub resolver assertion failure that aborts processes when search domains reach roughly 200 characters in glibc 2.26-2.44.

oss-securitySep 17, 16:59 UTC · Sep 17, 2026Vulnerability3 · 1 read

CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.

oss-securitySep 16, 23:13 UTC · Sep 16, 2026VulnerabilityCVE-2026-917521 · 1 read

USN-8737-2: GNU C Library vulnerabilities

Ubuntu extends glibc fixes to 24.04 LTS, patching buffer overflow in strfmon and out-of-bounds access in tdelete, both potentially leading to code execution.

Ubuntu Security NoticesSep 10, 11:25 UTC · Sep 10, 2026AdvisoryCVE-2026-19499 CVE-2026-195423 · 2 reads

Related CVEs

by mentions

CVE-2026-79992<1%7.8
Shell argument injection in GNU Emacs TRAMP (incomplete fix of CVE-2024-53920)
published Aug 25, 2026GNU Project (Free Software Foundation) Emacs TRAMP (bundled with GNU Emacs)
CVE-2026-1003107.3
Untrusted plugin search path in GNU libextractor
published Sep 25, 2026GNU libextractor
CVE-2026-917528.7
Stack Overflow DoS in GNU libextractor StarOffice Parser (pre-1.15)
published Sep 15, 2026GNU libextractor
CVE-2026-1089767.8
OS command injection in GNU Emacs and TRAMP via filename
published 19d agoGNU Emacs
CVE-2026-964427.8
Arbitrary Code Execution via Flymake in GNU Emacs
published Sep 23, 2026GNU Emacs
CVE-2026-962697.5
Arbitrary Code Execution via read-symbol-shorthands in GNU Emacs 28.1–31.1
published Sep 22, 2026GNU Project (Free Software Foundation) Emacs
CVE-2026-195425.6
Stack Buffer Overflow in GNU C Library (glibc) tdelete on Deep Trees
published Sep 14, 2026GNU Project GNU C Library (glibc)
CVE-2026-1152075.5
Arbitrary file creation in GNU patch reversal
published 8d agoGNU patch
CVE-2026-758181.8
Heap buffer overflow in GNU Aspell prezip-bin
published 24d agoGNU Aspell (prezip-bin)
CVE-2026-95510—
published —

Appears with

GNUorganization · 5
GNU Emacsproduct · 3
glibcproduct · 3
GNU C Libraryproduct · 3
Emacsproduct · 2
libextractorproduct · 2
telnetdproduct · 1
TRAMPproduct · 1
Red Hatorganization · 1
FreeIPMIproduct · 1
GNU Inetutilsproduct · 1
Canonicalvendor · 1
tdeleteproduct · 1
GNU Aspellproduct · 1
78ResearchLaborganization · 1
strfmonproduct · 1

Entities are extracted by the model from each article. First seen Sep 10, 2026, last mentioned 11h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.