OpenStack and Vim flaws, kernel CVE surge

OpenStack and Vim dominate the day's security traffic with command injection, authentication bypass, and memory-corruption advisories. The Linux kernel CNA also assigned hundreds of CVEs in a brief window, sparking debate over disclosure volume and triage.

OpenStack Ironic Python Agent root command injection

OpenStack published OSSA-2026-027 covering command execution in the Ironic Python Agent. Unsanitized ntp_server configuration values permit root-level injection through multiple attack vectors, with a CVE pending. Bare-metal provisioning operators should treat the agent as high-privilege and apply the fix without delay.

Vim heap buffer overflow on spellfile load

Vim versions before 9.2.0846 contain a medium-severity heap buffer overflow triggered while loading a spell file. The flaw was disclosed on oss-security. Users who open untrusted spell files risk crashes or further exploitation until they upgrade.

OpenStack Zaqar Keystone authentication bypass

OSSA-2026-029 reports that OpenStack Zaqar's unimplemented EXTRA-SPEC header bypasses Keystone authentication. Unauthenticated attackers who know a project UUID can reach queues. Deployments that rely on project isolation must install the patch.

Vimball plugin arbitrary command execution

Vim before 9.2.0847 allows arbitrary command execution via a crafted Vimball that writes to the .VimballRecord file. The vimball plugin is the affected component. Opening untrusted archives therefore carries elevated risk until the release is applied.

Vim use-after-free in JSON channel decoding

A use-after-free exists in JSON decoding for Vim releases from 9.2.0511 through 9.2.0843. The issue was announced on oss-security. Any workflow that exercises Vim's JSON channel support should move to a fixed build.

Linux kernel CNA assigns 432 CVEs

The Linux kernel CNA issued 432 CVEs in roughly thirty hours. The ensuing oss-security thread examines policy implications, prioritization feasibility, and distributor update strategies. Maintainers and packagers face renewed pressure on triage capacity.

Apache NimBLE BASS out-of-bounds write

CVE-2026-45813 covers incorrect data validation in Apache NimBLE's BASS add/modify source operation, producing an out-of-bounds write or integer underflow. The defect is corrected in 1.10.0. Bluetooth Low Energy stacks based on NimBLE should incorporate the update.

Apache HBase scanner owner check missing

CVE-2026-49326 describes a missing owner check on scanner fetch and close operations in Apache HBase's Thrift delegation service. The gap permits cross-user access via Thrift or REST. Multi-tenant deployments need to confirm the fix is present.