Search: “david”

3 stories in the last 7d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI industry 6 Vulnerability 6 AI safety & security 5 Research 3 Data breach 2 Industry 2 Policy & legal 2 AI policy 1 Exploit / PoC 1 Ransomware 1 Threat actor 1 Tools 1

SeverityAll critical 1 high 5 medium 3 low 5 info 17

Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

David Wheeler notes a rosbridge_library quadratic CPU cost flaw was publicly disclosed on oss-security without prior coordination.

In an oss-security reply, David A. Wheeler pointed out that a poster had just publicly disclosed details of a quadratic CPU cost issue in rosbridge_library's Protocol.incoming() JSON fallback path. Wheeler referenced the mailing list's stated norms encouraging public discussion of open-source security flaws. The reply itself contains no fix, CVE, or exploitation details.

oss-securitySep 14, 19:53 UTC · 2d agoVulnerability 3 sources

CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0-2.11.0 allows path manipulation when storing extension bundle content from uploaded NAR manifests (CVE-2026-87976, High).

Apache NiFi Registry versions 0.4.0 through 2.11.0 are affected by improper limitation of a pathname (CVE-2026-87976), rated High severity by the maintainers. When storing extension bundle content, the default file persistence provider used group, artifact, and version coordinates from uploaded NAR manifests as filesystem path components without sufficient validation. The disclosure was posted by Apache NiFi maintainer David Handermann on the oss-security mailing list.

oss-securitySep 16, 15:21 UTC · 19h agoVulnerability 4 sources CVE-2026-87976

CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

Apache NiFi CVE-2026-70469: duplicate or non-standard Content-Encoding headers bypass gzip request filtering in NiFi 2.11.0's REST API.

Apache NiFi disclosed CVE-2026-70469, rated High, affecting the Jetty-based REST API module (org.apache.nifi:nifi-jetty) in version 2.11.0. NiFi 2.11.0 disabled gzip-encoded HTTP requests and rejects those carrying the standard Content-Encoding header, but the framework enforcement filter fails to check multiple instances of the header and does not reject non-standard gzip identifiers, allowing crafted requests to evade the check. The disclosure was posted to oss-security by David Handermann.

oss-securitySep 16, 15:13 UTC · 19h agoVulnerability CVE-2026-70469