ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: oss-security

15 items in the last 24h

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 14Research 1
SeverityAllcritical 0high 5medium 4low 3info 3source: oss-security ✕

CVE-2026-91752: GNU libextractor < 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 has a stack-based buffer overflow (CVE-2026-91752) in its OLE2 parser, triggerable via crafted files.

A stack-based buffer overflow was identified in GNU libextractor's OLE2 plugin in versions prior to 1.15, assigned CVE-2026-91752. The flaw resides in the process_star_office function, which sizes a variable-length stack array using attacker-controlled OLE2 stream data. Attackers can craft malicious OLE2/StarOffice files to trigger the overflow. The issue was disclosed on the oss-security mailing list by researcher Haitam Lazaar on September 16, 2026.

oss-security · 2h agoVulnerability 2 sourcesCVE-2026-91752

Re: Retrospective by 'gpg.fail' authors

oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.

On the oss-security mailing list, Soatok Dreamseeker responds to a retrospective published by the gpg.fail authors, asking why unmaintained code is retained and stating that forgotten, unmaintained code is a liability and effectively unmaintained by definition. The visible reply addresses Werner Koch and concerns GnuPG code maintenance. No specific CVE, flaw, or exploitation is described in this snippet.

oss-security · 8h agoVulnerability 8 sources1

CVE-2026-89775: Guest-to-Host Escape in KVM/arm64

Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.

Researcher Hyunwoo Kim disclosed CVE-2026-89775, a guest-to-host escape in KVM/arm64, after the embargo agreed with linux-distros maintainers expired. The root cause is a type truncation of the stage-1 walk level that makes a size computation return 0, the value meaning 'size unknown'. The VNCR pseudo-TLB invalidation path then interprets that 0 as a valid value on ARM64 hosts where nested virtualization is enabled.

oss-security · 9h agoVulnerabilityCVE-2026-89775

CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

Apache MyFaces discloses moderate SSRF and local file inclusion vulnerability CVE-2026-68536 affecting all maintained 2.2 through 4.1 branches.

Apache MyFaces (org.apache.myfaces.core:myfaces-impl) disclosed CVE-2026-68536, a server-side request forgery and local file inclusion vulnerability rated moderate. Affected versions include the 2.2.*, 2.3.*, 3.0.*, 4.0.*, 4.1.* and 2.3-next-* branches. No exploitation details or patch status were provided in the disclosure.

oss-security · 10h agoVulnerability 2 sourcesCVE-2026-68536

CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing

Apache MyFaces fixes critical CVE-2026-76646, a remote denial-of-service flaw triggered by crafted request parameters across versions 2.2.0-4.1.3.

Apache MyFaces disclosed CVE-2026-76646, a critical denial-of-service vulnerability in which remote attackers can cause excessive resource consumption by supplying specially crafted request parameters. Affected versions span 2.2.0-2.2.15, 2.3.0-2.3.11, 3.0.0-3.0.3, 4.0.0-4.0.3, 4.1.0-4.1.3 and 2.3-next-*. The disclosure notes older versions may also be impacted.

oss-security · 10h agoVulnerability 2 sourcesCVE-2026-76646

CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0-2.11.0 allows path manipulation when storing extension bundle content from uploaded NAR manifests (CVE-2026-87976, High).

Apache NiFi Registry versions 0.4.0 through 2.11.0 are affected by improper limitation of a pathname (CVE-2026-87976), rated High severity by the maintainers. When storing extension bundle content, the default file persistence provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without sufficient validation. The disclosure was posted by Apache NiFi maintainer David Handermann on the oss-security mailing list.

oss-security · 10h agoVulnerability 4 sourcesCVE-2026-87976

CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration

Apache NiFi 2.11.0 Connector Migration REST APIs authorize only against the target Connector, skipping Process Group access checks (CVE-2026-86089, Low).

Apache NiFi 2.11.0 supports migrating version-controlled Process Group contents into a Connector via REST API methods that list eligible migration sources and submit migration requests. Both methods were authorized only against the target Connector, without evaluating user access to the involved Process Groups. The flaw, tracked as CVE-2026-86089, is rated Low severity and affects the nifi-web-api component.

oss-security · 10h agoVulnerability 4 sourcesCVE-2026-86089

CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods

Apache NiFi 1.5.0-2.11.0 flow update REST methods lack authorization checks for referenced components, permitting unauthorized Process Group flow replacement (CVE-2026-82561).

Apache NiFi 1.5.0 through 2.11.0 expose REST API methods that replace the entire contents of a Process Group with a client-supplied flow definition, including versioned flow update and rebase operations. Framework authorization for these methods was limited to read and write privileges on the target Process Group, without checking components referenced in the flow (CVE-2026-82561). No severity rating was provided in the disclosure; the affected version range is broad.

oss-security · 10h agoVulnerability 4 sourcesCVE-2026-825611

CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration

Apache NiFi 2.9.0-2.11.0 Connector configuration update and verification APIs skip authorization for referenced Assets and Secrets (CVE-2026-81866, Low).

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checks on Assets and Secrets referenced in the proposed configuration. Updating or verifying a Connector configuration can apply Asset and Secret references without the caller holding the required privileges. The issue, CVE-2026-81866, is rated Low severity and affects the nifi-web-api component.

oss-security · 10h agoVulnerability 4 sourcesCVE-2026-81866

CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.

oss-security · 10h agoVulnerabilityCVE-2026-70469

Re: Retrospective by 'gpg.fail' authors

GnuPG maintainer Werner Koch responds on oss-security to a gpg.fail retrospective covering 2003-era GnuPG code.

On oss-security, GnuPG lead developer Werner Koch replied to a retrospective published by the gpg.fail authors, citing a December 2003 commit in GnuPG's gettime.c affecting asctimestamp and printf format attributes in util.h. The excerpt contains no new CVE identifiers or exploitation evidence, and appears to revisit long-standing historical GnuPG code paths discussed by the retrospective's authors.

oss-securityupdated · 8h agofirst · 10h agoResearch 8 sources

Multiple vulnerabilities in Jenkins plugins

Jenkins releases security fixes for multiple plugins including Bitbucket, GitLab, Gitee, Coverage, and Gradle integrations.

Jenkins published security updates for several plugins, including Bitbucket Push and Pull Request Plugin 4.1.0, Bitbucket Server Integration Plugin 6.0.2, Coverage Plugin 3.3361.v0626103a_67e6, Gitee Plugin 1304.v2702f1d71cde, GitLab Plugin 1.2152.veec0897048b_0, and the Gradle Plugin. The announcement is a routine open-source security release notice without exploit details.

oss-security · 10h agoVulnerability 2 sources1

ISC has disclosed fourteen vulnerabilities in BIND 9 (CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, CVE-2026-81736)

ISC discloses fourteen vulnerabilities in BIND 9 DNS software, including a use-after-free, with fixes now available.

On September 16, 2026, Internet Systems Consortium disclosed fourteen vulnerabilities affecting BIND 9, listing CVE-2026-19033, CVE-2026-19662, CVE-2026-19666 (use-after-free), CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563, and CVE-2026-81736. Details and fixes are published in the ISC knowledge base. No active exploitation is reported in the announcement.

oss-security · 10h agoVulnerabilityCVE-2026-19033CVE-2026-19662CVE-2026-19666+11 CVEs

Unbound: 1.26.1 addresses multiple CVE items

Unbound 1.26.1 fixes critical heap buffer overflow CVE-2026-81642 in DNSKEY digesting that may allow remote code execution.

NLnet Labs released Unbound 1.26.1 on September 16 as a security release fixing several vulnerabilities, most notably CVE-2026-81642, rated CRITICAL, a heap buffer overflow during DNSKEY digesting that can possibly lead to remote code execution. Unbound is a widely deployed DNS recursive resolver and validating resolver. Administrators should upgrade promptly.

oss-security · 10h agoVulnerabilityCVE-2026-81642

Re: Retrospective by 'gpg.fail' authors

Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.

This is an oss-security mailing list reply by Sam James (Gentoo toolchain maintainer) to Werner Koch in the thread on the 'gpg.fail' authors' retrospective about GnuPG. James states that upstream projects like GnuPG should feel free to enable whatever -W* warning flags they need. He adds that distributions should not use -Werror indiscriminately, allowing narrow exceptions such as -Werror=format-security, and may reject warning-driven bugs that do not reflect real issues. No new CVE or vulnerability details are disclosed in this reply.

oss-securityupdated · 8h agofirst · 20h agoVulnerability 8 sources