Re: Proposal: Add separate oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Peter Gutmann backs splitting oss-security so Apache CVE floods do not bury the main list.
Stories per day · 30 days
11 RSS
Relatedpatch5oss-security3apache2citrix2f52hypervisor2nginx2rce2use-after-free2virtualization2vulnerability-disclosure2xenserver2advisory1alpr1apache-camel1canada1cert1cisco-talos1
136 stories, newest first · one card per story
Stories tagged #cve
Text::CSV_XS versions before 1.65 for Perl (8 CVEs)
Perl Text::CSV_XS before 1.65 has multiple flaws, including memory exhaustion, use-after-free, and data leakage.
F5 addressed critical RCE flaws in NGINX
F5 patched three critical NGINX flaws that can allow unauthenticated remote code execution.
F5 security advisory (AV26-1049)
Canada’s Cyber Centre urges updates for multiple NGINX and F5 products affected by three new CVEs.
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
Re: Incomplete fix for Emacs CVE-2026-79992
Salvatore Bonaccorso flags CVE-2026-108976 as an incomplete fix for Emacs CVE-2026-79992.
NSD 4.15.3 security release
NSD 4.15.3 fixes high-severity stack-overwrite bugs that could enable remote code execution.
Multiple TLS libraries: X.509 Name Constraints enforcement bypasses (CVE-2026-34073, CVE-2026-3833, CVE-2026-5263, CVE-2026-33810; CERT/CC VU#573195, VU#948176, VU#410595)
Multiple TLS libraries bypass X.509 name-constraint checks, tracked in four CVEs and three CERT/CC notes.
USN-8931-1: Apache HTTP Server vulnerabilities
Ubuntu patched Apache HTTP Server flaws that may leak data, misroute proxy requests, or allow denial of service or code execution.
From One Account to Every Mailbox: Breaking Zimbra's Identity Boundaries (Part 1)
Rapid7 details dozens of Zimbra flaws, including mailbox impersonation and cross-user access, with some fixes still missing.
Microsoft Breaks Patch Tuesday Record Again with 1400+ CVEs
Microsoft's October 2026 Patch Tuesday fixes 1,411 CVEs, including one actively exploited Windows Shell bypass.
4
Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
Progress fixed 31 MarkLogic Server flaws, including critical bugs that can give delegated managers persistent admin control.
3
Fwd: Announcing FreeType version 2.15.0
FreeType 2.15.0 fixes CVE-2026-95512, CVE-2026-50811, and vendored zlib flaw CVE-2026-27171.
Flock can now issue CVEs for its own products. Should we trust it?
Flock Safety became a CVE Numbering Authority for vulnerabilities in its own surveillance products.
2026-016: Critical Vulnerability in GitLab CE and EE
GitLab patches critical CVE-2026-97229 (CVSS 10.0) allowing unauthenticated RCE via CI/CD regex compiler, plus 23 other security issues in CE/EE versions.
USN-8912-1: Perl DBI module vulnerabilities
Ubuntu's USN-8912-1 patches Perl DBI flaws that may allow code execution or denial of service.
USN-8911-1: Linux kernel (OEM) vulnerabilities
Ubuntu patched multiple Linux kernel OEM flaws that could let attackers compromise affected systems.
October 2026 Patch Tuesday forecast: Time for an Office cleanup
October 2026 Patch Tuesday forecast after September's record 973 Microsoft CVEs; Apple already patched exploited zero-day CVE-2026-86950.
8
[OSSA-2026-044] OpenStack Mistral: Four authorization and privilege vulnerabilities in Mistral (CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147))
OpenStack Mistral has four authorization and privilege flaws in OSSA-2026-044.
Cisco warns of critical flaws allowing Nexus switch takeover
Cisco disclosed five critical NX-OS flaws that can give root code execution on Nexus 3000 and 9000 switches.
Elastic Patches 14 Security Flaws, Including One Enabling Cross-Tenant Data Interception
Elastic patched 14 flaws, including a Kibana bypass that can intercept another tenant's data.
8
Microsoft, Adobe, Apple, and Foxit vulnerabilities
Cisco Talos disclosed patched vulnerabilities in Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows.