OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 High Use-After-Free in X.509 Extension Cache Under Concurrent Use CVE-2026-84783 Moderate Excessive Memory Allocation in Relative CRLDP Processing CVE-2026-35189 Low QUIC Unvalidated...

RusTLS FFI -- plaintext TLS handshake vulnerability

The RusTLS project reports: TLS 1.3 handshake message processing could allow a broken peer to send plaintext handshake messages where an encrypted one is expected without rustls rejecting the connection...

Gitlab -- vulnerabilities

Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE Missing Authorization issue in Duo AI job troubleshooting...

p5-Dancer2 -- Multiple vulnerabilities

Dancer project reports: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not...

p5-Dancer2 -- Multiple vulnerabilities

Dancer project reports: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app. hookexception, then calls cleanup unless the failing hook is the exception handler. ...

chromium -- security fixes

Chrome Releases reports: This update includes 108 security fixes: 551573368 Critical CVE-2026-95350: Buffer overflow in ANGLE. 530045332 Critical CVE-2026-95357: Out of bounds write in GPU. 548585299 Critical CVE-2026-95339: Use after free in ServiceWorker. 551708184 Critical CVE-2026-95281: Buff...

Erlang/OTP -- multiple vulnerabilities in ssl, ssh and asn1

The Erlang/OTP project reports: OTP 29.1.1, 28.5.0.7 and 27.3.4.18 fix the following issues: CVE-2026-89422: TLS 1.3 client skips server authentication on unsolicited PSK. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

databases/p5-DBI -- multiple vulnerabilities

DBI project reports: DBI 1.650, 1.651, 1.652, 1.653 and 1.654 fix the following issues: CVE-2026-88815: Fix DBI::sqltypecast on IV/NV CVE-2026-88816: Fix FetchHashKeyName on IV/NV CVE-2026-78030: Fix arbitrary module and file loading via dbmtype/dbmmldbm CVE-2026-15392: Tighten symlink outside of...

mailpit -- Multi-frame animation bypass of thumbnail pixel budget

Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 "Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4 bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PN...

Angie -- worker process memory corruption when using HTTP/3

The Angie Software Team reports: When using an OpenSSL version without native HTTP/3 support 3.5.0 or earlier, if the default server for the address that accepted a regular HTTPS request also used HTTP/3 the listen directive with the quic parameter, possibly on a different port, while a server...

Rauthy -- Multiple security vulnerabilities

The Rauthy project reports: WebAuthn authentication code is not bound to the user. GHSA-x8jp-v2j6-6vjf Refresh-token grant accepts a caller-supplied client without verifyinG it matches the token's azp, allowing cross-client token minting and identity/scope confusion...

podman -- vulnerabilities

The Podman developers report: This release addresses CVE-2025-11395, where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host. This release also addresses...

Vinyl/Varnish -- VCL string methods workspace overflow

Vinyl Development Team reports: A workspace buffer overflow vulnerability was found in the .upper and .lower string type methods of VCL. This can be used as a remote denial of service DoS vector to make the child process segfault or assert, and then restart. Effectively exploiting this...

nginx -- buffer overflow when using ngx_http_v3_module

The nginx development team reports: Buffer overflow when using ngxhttpv3module CVE-2026-90439. Severity: medium. A heap memory buffer overflow might occur in a worker process under certain configurations when using HTTP/3 with OpenSSL 3.5.0 and earlier...

Unbound -- multiple vulnerabilities

NLnet Labs reports: This release consolidates security fixes for issues reported over a period of time. There are fixes for: CVE-2026-81642: Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY. CVE-2026-81634: Possible heap buffer overflow during DNSSEC canonicalization...

anki -- multiple vulnerabilities

Abdo Hasani reports: Imported note HTML may execute inside an embedded image-occlusion document that retains the editor profile's desktop API credentials. This could cross the boundary between untrusted note content and privileged desktop operations. An improper path validation vulnerability allo...

znc -- multiple vulnerabilities

ZNC reports: CVE-2026-82373: Use-after-free when unloading modules, triggered by unprivileged users. To mitigate, set DenyLoadMod to true. CVE-2026-82374: Null pointer dereference in crypt module, triggered by IRC server. CVE-2020-11022, CVE-2020-11023: Updated the old bundled vulnerable version ...

Gitlab -- vulnerabilities

Gitlab reports: Path Traversal issue in repository commits API impacts GitLab CE/EE Insecure Deserialization issue in GraphQL subscription serializer impacts GitLab EE Buffer Overflow issue in Unicode conversion wrapper impacts GitLab EE Scheduled Pipeline Execution Policy test allows Developers ...

cjose -- Heap-based Buffer Overflow

https://github.com/OpenIDC/cjose/security/advisories/GHSA-75r7-f5cv-g3wj reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. Prior to version 0.6.2.5, cjose's JWE decryption path for the AES Key Wrap key-management algorithms alg = A128KW, A192KW,...

cjose -- Use of Hard-coded Cryptographic Key

https://github.com/OpenIDC/cjose/security/advisories/GHSA-f6wf-pqg3-6wqq reports: OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption JOSE. In versions 0.6.1 through 0.6.2.5, when cjose encrypts a JWE using an AES-CBC-HMAC content-encryption algorithm...

389-ds-base -- multiple vulnerabilities

The 389 Directory Server project reports: CVE-2026-11770: the replication extended operations did not verify that the bind DN is accepted by the replica, and the CleanRUV status filters were open to LDAP injection. CVE-2026-18355: a missing minimum length check in sasliostartpacket lets an...

strongSwan -- multiple vulnerabilities

The strongSwan project reports: strongSwan 6.1.0 fixes eleven vulnerabilities: CVE-2026-78123: A flaw in the openssl plugin in the processing of PKCS7 containers can result in a crash. Affects 5.0.2 and newer. CVE-2026-78124: A flaw in the openssl plugin in the enumeration of certificates in PKCS...

Roundcube -- Multiple vulnerabilities

The Roundcube project reports: CSS declaration smuggling via un-encoded ampersand emission CSS property injection via body background attribute email header injection via bare CR in the subject field email header injection via C-escape \r in the recipient display name email header injection via...

p5-Authen-SASL -- Replay attack in Authen::SASL::Perl::DIGEST_MD5

Authen-SASL project reports: Authen::SASL::Perl::DIGESTMD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in serverstep. serverstart generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-qqjf-53cj-pwvv HTTP/3 Backend NTLM Connection Reuse GHSA-f52w-8j3h-j724 bypassing path-scoped routing GHSA-v67p-phpq-fc8x entrypoint header-name sanitization bypass GHSA-w4v4-9rw7-5326 HTTP Request/Response...

OpenVPN: denial of service

OpenVPN team reports: OpenVPN 2.x allows attackers to potentially cause a denial of service against the control channel reliability layer, either by driving the reliable TLS retransmission timeout to grow without bound, or by sending acknowledgements for packets that cannot be outstanding...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory 2026-09-02: High SECURITY-3972 / CVE-2026-84645: Deserialization vulnerability Medium SECURITY-3908 / CVE-2026-84646: Lack of type restriction in deserialization High SECURITY-3915 / CVE-2026-84647: Instantiation of any types related to configuration High SECURITY-3967 /...

angie-module-njs -- multiple vulnerabilities

The njs development team reports: Access control bypass in jsaccess when an asynchronous request body continuation threw an exception or produced an unhandled rejection CVE-2026-18329. Previously, nginx could continue processing the request as though the jsaccess check had succeeded. Affects...

njs -- heap buffer overflow in XML exclusive canonicalization

F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when xml.exclusiveC14n processes a crafted XML namespace prefix list. This may lead to worker process crashes, heap corruption or memory disclosure. The NGINX SAML reference implementation is affected because it...

py-strawberry-graphql -- Incorrect authorization

Patrick Arminio reports: "PermissionExtension.resolve" evaluates the return value of "haspermission" for truthiness on the synchronous path. "supportssync" only classifies a permission as asynchronous when "haspermission" is declared with "async def" via "inspect.iscoroutinefunction", so a plain...

Erlang/OTP -- multiple vulnerabilities in inets, stdlib, snmp and eldap

The Erlang/OTP project reports: OTP 29.0.6, 28.5.0.6 and 27.3.4.17 fix the following issues, most of them in the inets httpd and httpc implementations: CVE-2026-55951: httpc Memory Exhaustion via Unbounded Header Accumulation. CVE-2026-59696: stdlib: Denial-of-Service enabled by Unbounded Integer...

electron42 -- multiple vulnerabilities

Electron developers report: This update fixes the following vulnerabilities: CVE-2026-15764, CVE-2026-15765, CVE-2026-15766, CVE-2026-15767, CVE-2026-15768, CVE-2026-15769, CVE-2026-15770, CVE-2026-15771, CVE-2026-15772, CVE-2026-15773, CVE-2026-15774, CVE-2026-15775, CVE-2026-15776,...

chromium -- security fixes

Chrome Releases reports: This update includes 26 security fixes: 522307103 Critical CVE-2026-84353: Use after free in Shared Tab Groups. 546260492 Critical CVE-2026-84352: Use after free in WebGL. 498839176 High CVE-2026-84354: Incorrect authorization in FileSystem. 514078656 High CVE-2026-84359:...

popt -- Incorrect Calculation of Buffer Size

https://access.redhat.com/errata/RHSA-2026:56984 reports: A flaw was found in popt. This vulnerability allows an attacker to provide specially crafted configuration content to a host, which, when loaded, can lead to a small memory corruption issue. This occurs because of an error in how the...

Erlang/OTP -- remote crash via gen_tcp with {packet,4}

The OTP 29.0.6 release notes report: A gentcp socket using the inet driver and packet,4 had a bug if receiving a packet with size just below INTMAX. That packet size wrapped in size calculations and made the received data overwrite its allocation and trash allocator metadata and subsequent blocks...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname CVE-2026-16093: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16072: Organization...

security/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions

Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using sudoedit, are still able to place files in arbitrary directories. This only affects systems where sudoedit is used to give very fine-grained edit permissions, which is not the default...

CrowdSec -- multiple vulnerabilities

The CrowdSec Team reports: GHSA-g2x2-jgfg-pg7g: HTTP acquisition datasource lacks a decompressed body cap and trusts Content-Length. GHSA-rh69-4vqj-9gj8: Unbounded request-body read in kubernetes-audit acquisition webhook...

Gitea -- multiple vulnerabilities

Gitea reports: This release contains fixes for 26 security issues, hardens issue searching that an unfiltered query no longer enumerates every public repository into the indexer filter and removes unsafe code from the internal private endpoints. Please upgrade as soon as possible...

Elixir -- Denial of service via uncontrolled recursion in charlist conversion

tomciopp reports: Uncontrolled recursion in the Elixir standard library lets an attacker who controls a list passed to inspect/1, List.tostring/1, or List.tocharlist/1 exhaust a BEAM node's memory. Inspect.List checks only a bounded prefix 4096 elements by default to determine whether a list is a...

immich -- locked assets remain accessible through shared albums and links

VulnCheck reports: Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. In 3.2.2 the single-asset endpoint still lacks the album removal that the bulk...

Elixir -- Denial of service via uncontrolled recursion in charlist conversion

tomciopp reports: Uncontrolled recursion in the Elixir standard library lets an attacker who controls a list passed to inspect/1, List.tostring/1, or List.tocharlist/1 exhaust a BEAM node's memory. Inspect.List checks only a bounded prefix 4096 elements by default to determine whether a list is a...

net-p2p/c-lightning -- unknown vulnerability

Core Lightning team reports: This point release includes fixes for vulnerabilities responsibly reported by a number of sources. It also comes at a time when increasingly capable AI models are being used to identify potential vulnerabilities in open-source code, significantly increasing the volume...

PHP Composer -- Multiple vulnerabilities

Composer project reports: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Fixed command injection via malicious Perforce url GHSA-rvx4-ffvw-m9q3...

redpanda-connect -- memory exhaustion via oversized AMQP frames

amqp091-go developers report: Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated framemax limit. This can lead to unexpected memory consumption or application-layer denial of servi...

NSD -- multiple vulnerabilities

NLnet Labs reports: CVE-2026-18664: IP range access control restrictions are bypassed for some unintended IP. Reported by Qifan Zhang from Palo Alto Networks, Claude and Ada Logics. CVE-2026-18916: Any remote client can denial TCP service by throttling the TCP receive window down to 1. Reported b...

Gitlab -- Vulnerabilities

Gitlab reports: Inclusion of Functionality from Untrusted Control Sphere issue in Duo Claude AI agent impacts GitLab EE Denial of Service issue in import pipeline impacts GitLab CE/EE Denial of Service issue in SCIM API impacts GitLab EE Improper Access Control issue in protected environments...

conduit -- authentication bypass vulnerability

Conduit team reports: Fixes a vulnerability where endpoints which required authentication, but functionality do not depend on the user/server calling it, could have their authentication bypassed, as well as causing crashes for all other authenticated endpoints. It is recommended you upgrade ASAP...

FreeBSD -- Unauthorized credential switching

Problem Description: In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This...

FreeBSD -- Use-after-free in unix SOCK_STREAM message handling

Problem Description: The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. Impact: An unprivileged loca...