Revive SQLi advisory and a contested Forwarded draft

A high-severity blind SQL injection advisory for Revive Adserver led the day's security mail, while an IETF proposal to put user signals in the Forwarded header drew privacy objections. A routine Apple HomeView update was the remaining item.

Revive Adserver publishes blind SQL injection advisory

Revive Adserver issued REVIVE-SA-2026-004, a high-severity blind SQL injection advisory tracked as CVE-2026-107662 with a CVSS score of 8.8, covering versions through 6.0.8. The notice went out on the Full Disclosure list. Sites still on those releases have a direct reason to read the advisory and plan an upgrade.

Draft would add user signals to the Forwarded header

A new draft proposes user-context parameters on the Forwarded HTTP header. In nine messages from five participants on the IETF HTTP working group list, several people objected on privacy, consent, and efficacy grounds. The argument matters to anyone building proxies or intermediaries, because Forwarded already carries client information and extra user context would widen what that header discloses.

Apple posts HomeView 27.2 security advisory

Apple published APPLE-SA-11-12-2026-1 for HomeView Software version 27.2, a routine advisory that fixes several CVEs in the closed-source product. The note is peripheral to open source and open standards work, but it is the vendor's published fix list for that release.