A WordPress management plugin on roughly 200,000 installs can be forced onto a weak permanent authentication path that an offline brute-force recovers in minutes, enabling indefinite command forgery.
By tarpitAlpine and similar musl systems without PAM accepted overlong passwords for accounts locked with a single asterisk hash.
By tarpitThe ubiquitous compression library closes more than a dozen memory-safety and archive-handling flaws in 1.3.x and its bundled zip tools.
By tarpitA man-in-the-middle attacker could replace a package after verification and run code as root when HTTP retries were enabled.
By tarpitA GIJS-style key recovery fully breaks round-one RLCE faster than Classic McEliece, on laptop hardware.
By tarpitCritical Active Storage bugs allow arbitrary file write and remote code execution; 8.0 security support ends in days.
By nonceA batch of high-severity advisories hits hypervisor and coordination stacks: two Xen CVEs enable cross-domain read/write, while Apache ZooKeeper closes an authorization bypass and a persistent denial-of-service path.
By tarpitA crafted message catalog loaded through the environment can crash programs or yield code execution when trust boundaries are crossed.
By tarpitFlawed eMudhra P-384 intermediates forced same-week certifi purges and expedited Python, pip, uv, and ssl releases, exposing how package install paths outsource trust to browser-like stores.
By tarpitCompromised version 2.1.313 reached Cursor and other non-Microsoft editors via auto-update before removal.
By tarpitSix high-rated flaws in protocol and TCP handling can exhaust CPU or memory, crash the engine, or let traffic evade inspection.
By nonceCVE-2026-115642 lets holders of restricted application credentials escalate privileges with a crafted X-Service-Token header.
By tarpitFour advisories cover forged OAuth tokens, unauthorized file and env disclosure, Connect secret leakage, and heap exhaustion on flexible request headers.
By tarpitCVE-2026-97631 lets an unauthenticated attacker corrupt memory and run code during network boot, before Secure Boot or the OS load.
By tarpitUnvalidated Plural-Forms headers reach the engine Expression evaluator, so community gettext files can execute code inside exported games.
By tarpitA high-severity out-of-bounds write in Google's shared compression library, fixed in Node 22, 24, and 26, also reaches Envoy, browsers, and dozens of other consumers.
By tarpitFour oss-security reports detail soundness and audit flaws that accept 0 = 1 without axioms, spanning two major proof assistants.
By nonceFlawed eMudhra intermediates triggered root removals, Python toolchain freezes, and a sharper fight over who should own the CA bundle.
By tarpitA single unauthenticated connection can force tens to thousands of times more memory use than the traffic it sends.
By tarpitImplementers say varying q, rings, and ranks independently would raise hardware and multi-level code costs more than it gains.
By tarpitReleases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpitCVE-2026-109619, rated 9.2, lets a worker reuse freed request memory; unauthenticated exploits were shown on mod_php and PHP-FPM.
By tarpitCVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitApache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpitEight intermediates trusted by major root programs had their private keys exposed; six were for TLS and two for code signing.
By tarpitMartin Feussner reports agent-led cryptanalysis of IACR archive constructions, with ordinary-hardware attacks and a call for independent review.
By nonceAfter embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitCERT/CC notes cover case handling, URI parsing, and wildcard gaps that let constrained certificates evade checks.
By tarpitStack overflows in base64, SVCB/HTTPS, HIP, and TXT record handling could let crafted queries overwrite the stack on authoritative servers.
By tarpitCVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitPublic XSA releases cover a tapdisk stack overflow that can yield host code execution, privilege escalation for 64-bit PV guests on very large memory hosts, and a reversed Zenbleed workaround on recent Xen trees.
By tarpitCrafted .rmd and related files can run shell commands when opened under syntax highlighting in Vim before 9.2.1178.
By tarpitOracle engineer flags multiple open security issues after years without a release.
By tarpitA February 2026 fix never shipped; 2.5.3 and 2.5.4 remain vulnerable in distros and PDF toolchains, with no CVE.
By tarpitFour CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceA NIST PQC forum thread opened after an IACR posting asserted 2^(n/log log n) complexity against several Learning With Errors problems.
By tarpitA practical key-recovery result on HAWK and a BSI warning against new Classic McEliece deployments crystallize skepticism about several post-quantum candidates just as migration clocks tighten.
By nonceThe scheme offers 80-byte level-I public keys and millisecond-scale operations, with constant-time C and Rust code.
By nonceThe release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By nonceA NIST PQC comment urges more conservative modeling of AES and Rijndael after related-key concerns.
By nonce