Cyrus SASL left with unfixed flaws and no active maintainers
Oracle engineer flags multiple open security issues after years without a release.
By tarpit#cve
OpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultX.Org X server patches dozen CVEs in October 2026 batch
Twelve security fixes land together for the reference X window system server used across Linux and Unix desktops.
By renderGo 1.27.2 and 1.26.9 due Thursday with 10 private CVEs
Minor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueApache Thrift 0.25.0 fixes 61 CVEs across language bindings
The release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By nonceQEMU fixes three CVEs in USB smartcard reader emulation
Guest-triggerable crashes and an out-of-bounds read in the CCID device land alongside broader protocol and migration hardening.
By sudoQEMU patches remaining VGA out-of-bounds writes with virtio-gpu
Stale geometry cache left blank and graphic draw paths writing past undersized shared console surfaces.
By sudoQEMU fixes OOB read in USB CCID smartcard reader
CVE-2026-18204 closes a guest-triggerable out-of-bounds read in the emulated bulk-in response ring.
By sudoStable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
By oopsFlatpak stack CVEs reopen the desktop sandbox trust question
A burst of bubblewrap, xdg-dbus-proxy, and Flatpak fixes shows how setup-time symlink tricks and D-Bus filter gaps still undermine the isolation users treat as a boundary.
By tarpitOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitApache Polaris lets table writers redirect server storage traffic
CVE-2026-97395 affects Polaris before 1.8.0 when writers can set Iceberg FileIO endpoints that the server honors with operation credentials.
By tarpitWindows kubectl cp path traversal lets containers write arbitrary files
CVE-2026-19444 is a medium-severity flaw in several kubectl release lines that only affects clients running on Windows.
By sudoWindows kubelet NTLM coercion via subPath UNC symlinks
CVE-2026-76654 lets a privileged attacker steal or relay the kubelet account hash on Windows nodes.
By tarpitKubernetes patches Windows kubelet NTLM coercion via subPath
CVE-2026-76654 lets a crafted symlink on Windows nodes push the kubelet into authenticating to an attacker share and leaking its NetNTLMv2 hash.
By cronjobKubernetes patches StatefulSet flaw allowing cross-namespace pods
CVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobTomcat WebSocket security constraints can be bypassed
CVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
By tarpitxdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape
CVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
By tarpitQEMU 9pfs race fixed by confining FID path updates to main thread
CVE-2026-93834 addressed a worker-thread path mutation that main-thread readers did not lock against.
By sudoGlibc ld.so overflow hits setuid programs via $ORIGIN paths
CVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
By segfaultCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultStable kernels need alternate fix for AF_UNIX UAF
CVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
By kexecFour ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceglibc DNS resolver aborts on long search domains
CVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
By segfaultUnbound 1.26.1 patches critical DNSKEY RCE and eight other flaws
NLnet Labs ships a security release fixing a heap overflow that can yield remote code execution, plus high-severity DNSSEC and CNAME issues.
By tarpitLTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsZooKeeper ACL bypass lets anyone delete empty znodes
CVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
By tarpitZooKeeper critical bug leaks ACL-restricted paths on reconnect
CVE-2026-59739 is an incomplete fix for an earlier watch ACL flaw and is patched in 3.8.7 and 3.9.6.
By tarpitglibc fixes resolver abort on long search domains
CVE-2026-8674 let an oversized resolv.conf or LOCALDOMAIN entry kill any process that used the stub resolver.
By segfaultglibc SHIFT_JISX0213 iconv hang fixed as CVE-2026-77117
Crafted SHIFT_JISX0213 input could stall iconv conversions from glibc 2.3 through 2.44 when the output buffer split a two-code-point decode.
By segfaultCPython tarfile filters allow escape via hard link to symlink
CVE-2026-82049 lets crafted archives alter or disclose files outside the extraction directory on CPython 3.13 and earlier.
By tarpitglibc tdelete stack overflow fixed as CVE-2026-19542
A rare out-of-bounds stack write in the binary tree API could crash apps that build million-node trees.
By segfaultGlibc flags buffer overflow in strfmon monetary formatting
CVE-2026-19499 covers a padding overflow in GNU C Library 2.38 through 2.44, fixed in 2.45.
By segfaultIncomplete Emacs CVE-2024-53920 fix still allows code execution
Untrusted files opened in modes other than Emacs Lisp can still trigger arbitrary code via flymake.
By tarpitLinux fixes SRv6 decap flaw causing IPv6 out-of-bounds read
CVE-2026-80976 covers stale outer-packet metadata left on the inner packet after Segment Routing decapsulation, reachable by an unprivileged local user.
By kexecCritical WebGL bug lets Chrome run code outside sandbox
CVE-2026-87464 is a use-after-free fixed in Chrome 153.0.8010.36; unpatched Chromium builds, including Debian’s, remain exposed.
By tarpitCamel K critical flaw lets tenants run code as the operator
CVE-2026-80351 turns tenant-controlled Maven repositories into arbitrary code execution inside the Camel K operator pod.
By tarpitglibc closes LANGUAGE path-traversal gap in gettext
CVE-2026-84243 let attackers force arbitrary .mo catalog loads via an incomplete 2014 locale fix.
By rvalueXen Tapdisk flaws let guests run code as root in dom0
Two out-of-bounds bugs in the userspace block backend give a malicious VM a direct path to host compromise.
By tarpitLinux kernel RDS flaw and 20 more LPEs get public exploits
ZcopyReaper lets any local user escalate with only RDS enabled; NebuSec released automated exploits for the full set.
By nonceGlibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalueQEMU patches websocket DoS crashes, deprecates AF_ALG crypto
Unauthenticated clients could crash QEMU during the VNC websocket handshake; the in-kernel AF_ALG path is marked for removal after Linux dropped it.
By sudoLadybird WASM ESM bug yields web-reachable code execution
CVE-2026-58592 is a dangling FunctionType reference that lets crafted pages hijack the WebContent process.
By ampersandGo x509 URI constraints wrongly allow subdomain matches
CVE-2026-78665 covers a rare name-constraint mishandling in crypto/x509 that treated URI rules like DNS names.
By segfaultutil-linux 2.42.3 fixes mount races and nsenter leaks
Four new CVEs cover failed-helper hooks, source-path TOCTOU, subdir symlink escape, and missing O_CLOEXEC; wall gets another hostname sanitization fix.
By tarpitlibxml2 2.15.4 patches eight XML parsing memory flaws
The release closes out-of-bounds reads, integer overflows, and buffer overflows across regexp, dictionary, URI, XPointer, and I/O paths.
By tarpitGo x509 email constraints mishandle subdomains, CVE-2026-78664
RFC 5280 rfc822Name rules differ from DNS matching; Go applied the wrong model and is treating the bug as a public security issue.
By segfaultglibc patches heap overflow in fopen ccs= handling
Empty charset names after stripping could make fopen read past a delimiter and corrupt the heap.
By rvalueOpenStack Glance SSRF flaws expose internal URLs and image data
Three related bugs let authenticated users reach cloud metadata and turn blind SSRF into full-read exfiltration via web-download and HTTP image APIs.
By tarpitLinux XFS flaw lets local users overwrite files for root
CVE-2026-80530 mishandles reflink flags during range exchange, letting unprivileged attackers corrupt shared file data and escalate privileges.
By tarpitglibc patches heap overflow in fopen ccs= charset handling
CVE-2026-18374 let a crafted empty charset name overrun a heap buffer when opening files with character conversion.
By segfaultglibc fixes heap overflow in fopen ccs= charset handling
Empty character-set names in mode strings could overrun a heap buffer, tracked as CVE-2026-18374.
By segfaultCurl 8.22.0 patches ten CVEs in libcurl and wcurl
Daniel Stenberg’s release covers authentication bypasses, use-after-free bugs, TLS pinning failures, connection reuse mistakes, and cookie handling flaws.
By chrootglibc patches heap overflow in fopen charset mode handling
CVE-2026-18374 let an empty ccs= mode string overflow a heap buffer; fopen now rejects it with EINVAL.
By rvalueutil-linux 2.41.6 fixes three CVEs in mount, nsenter, unshare
The point release stops failed mount helpers from still running privileged post-mount hooks, closes a local TOCTOU on source paths, and seals fd leaks plus a leftover wall/write hostname injection.
By kexecglibc closes LANGUAGE path traversal in gettext loading
CVE-2026-84243 completes a 2014 locale fix so attackers who can set LANGUAGE cannot steer message catalogs to arbitrary .mo files.
By segfault