Roundcube -- Multiple vulnerabilities

The Roundcube Mail project reports: IMAP command injection via CRLF in uid parameter of mail/headers and mail/viewsource action bug where an alias login wasn’t qualified by IMAP host Add a size limit to the CSS proxy content processing SSRF filter islocalurl bypass via NAT64 64:ff9b::/96 remote...

libXpm -- vulnerability

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-94287: Denial of service via unsigned underflow in libXpm's write path...

libXi -- multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-93541: Out-of-bounds read in libXi's XQueryDeviceState CVE-2026-93542: Out-of-bounds read in libXi's XI2 class parsing via sizeclasses...

libXrender -- vulnerability

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-88807: Out-of-bounds read in libXrender's XRenderQueryFormat reply parser...

libX11 -- multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-88806: Out-of-bounds write vulnerability in libX11's XKB X Keyboard Extension action parser CVE-2026-94283: Out-of-bounds read...

libXtst -- multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X client library implementations published by X.Org for which we are releasing security fixes for. CVE-2026-94286: Out-of-bounds read in libXtst's RECORD reply parser CVE-2026-109088: libXtst RECORD EnableContext Reply Endless Loop...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-p8wx-ph99-xgcr mTLS auth-tls-secret silently disabled for a host GHSA-ww7c-q3mv-xx22 Data race on the shared bufio.Reader GHSA-28hp-c82p-8vqj TLS-option cache hit skips the cross-namespace authorization check...

Text::CSV_XS -- multiple vulnerabilities

H.Merijn Brand - Tux reports: Text::CSVXS versions before 1.65 have these vulnerabilities listed below. CVE-2026-110759: parse : report trailing lone CR, do not store EOF as 0xFF CVE-2026-110758: Under allowwhitespace, do not strip beyond field start CVE-2026-110757: combine : decide quoting from...

Erlang/OTP -- erl_tar denial of service via crafted GNU sparse member

https://github.com/erlang/otp/security/advisories/GHSA-phm5-m6cj-5382 reports: A loop with unreachable exit condition 'infinite loop' vulnerability in the erltar module allowed an attacker who supplied a tar archive to cause a denial of service via a crafted GNU sparse member with a trailing hole...

nginx -- multiple vulnerabilities

The nginx developers report: A buffer overflow might occur in a worker process when using the "alias" directive if the request URI was changed by the "rewrite" directive and was then mapped to a file path CVE-2026-15176. A buffer overflow might occur in a worker process while evaluating string...

Drupal 10 and 11 -- remote code execution

Drupal core reports: A remote code execution vulnerability exists within the Field UI module in Drupal core. The vulnerability is not directly exploitable with core alone, but multiple serious exploit paths exist with contributed modules. At least one known exploit path does not require...

Erlang/OTP -- multiple vulnerabilities in ssl, inets, public_key and snmp

The Erlang/OTP project reports: OTP 29.1.2, 28.5.0.8 and 27.3.4.19 fix the following issues, three of which complete earlier incomplete fixes: CVE-2026-105236: DTLS-1.2 session resumption could cross SNI virtual-host boundaries. An SNI-aware server resumed a cached session even when the resumptio...

NSD -- multiple vulnerabilities

NLnet Labs reports: This security release has fixes for vulnerabilities which were all for cases with specially crafted and formatted data in zone files. Zone files which are written out by NSD itself, such as for zones for which NSD is secondary, would not be formatted like this. The zone file h...

FreeBSD -- Multiple vulnerabilities in bhyve device models

Problem Description: Several vulnerabilities were found in the bhyve hypervisor's device models. The xHCI USB 3 device model did not validate or save the event ring size provided by the guest. The size was re-read from guest memory on each use, and Transfer Request Block TRB fields were loaded...

FreeBSD -- TOCTOU race between sound(4) buffer resizing and mmap

Problem Description: When an audio channel's buffer needs to be resized, the sound4 driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap2 call on another thread can complete during this window, after which the resize path frees the...

FreeBSD -- Remotely triggerable buffer overflow in tcp_rack

Problem Description: When the PCM sample array needs to grow, the RACK stack doubles a 16-bit allocation counter. Repeated doublings caused the counter to wrap to zero, resulting in a near-zero-length allocation followed by a copy of the existing samples into the undersized buffer. A remote peer...

Curl -- Multiple vulnerabilities

The Curl project reports: local interface connection reuse mixup CVE-2026-107929 info leak uploading over WebSockets with GnuTLS CVE-2026-107928 password leak in CURLINFOEFFECTIVEURL CVE-2026-94266 Authorization: Negotiate sent to foreign origin CVE-2026-94265 server-set cookie aborts cookie jar...

mod_wsgi -- race condition at process start can leak request context between requests

Graham Dumpleton reports: A race condition at process startup could let two threads be handed the same per-thread record, because records were allocated from an Apache memory pool shared by every thread without a lock. Threads sharing a record also shared the modwsgi.threadid value and, for named...

p5-Plack -- Multiple vulnerabilities

Plack project reports: SECURITY Fix memory leak of every request env in Plack::Middleware::Recursive CVE-2026-110333 Plack::Request::Upload-basename never returns '', '.' or '..' CVE-2026-110332 Plack::App::URLMap matches SERVERPORT literally when stripping it from Host CVE-2026-110335 BUG FIXES...

Gitlab -- vulnerabilities

Gitlab reports: Integer Overflow issue in CI/CD Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in syntax highlighting impacts GitLab CE/EE Improper Authorization issue in downstream pipeline creation service impacts GitLab CE/EE Permissive Regular Expression issue in...

nginx-module-cache-purge -- symlink traversal when walking cache trees

The ngxcachepurge developers report: Fixed a symlink traversal vulnerability during cache tree traversal. An attacker with the ability to create symbolic links inside the cache directory could potentially cause cache purge operations to delete arbitrary files accessible to the NGINX worker proces...

Timing leaks of the nonce in ECDSA, EdDSA and DSA signatures

Helder Eijs reports Fix timing leaks of the nonce in ECDSA, EdDSA and DSA signatures The signing time depended on the secret nonce, enough to recover the private key with a lattice attack. - EC: scalars are encoded and processed on the full length of the order, and ecmixadd is constant time for t...

podman -- vulnerabilities

The Podman developers report: This release addresses CVE-2026-94603, where a "podman run" on a checkpoint image any image with the io.podman.annotations.checkpoint.runtime.name annotation could disable all sandboxing, including sandboxing specified by the user, when the container was created...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0078: Type confusion crash in GValue list comparison when parsing caps GStreamer-SA-2026-0083: Out-of-bounds read and write in GStreamer video meta deserialization...

mutt -- Heap out-of-bounds write via crafted Content-Header line

Kevin J. McCarthy reports: Fixing an OOB heap write. This is triggered by a specially crafted Content-Header line in an email that is used as a template for a new email, via . Thanks to Calif.io, in collaboration with Anthropic for sending me a detailed write up and suggested patch...

xorg -- Multiple vulnerabilities

X.Org reports: Multiple issues have been found in the X server and Xwayland implementations published by X.Org for which we are releasing security fixes for in xorg-server-21.1.25 and xwayland-24.1.14. CVE-2026-88812: XKB SetGeometry TextDoodad Double Free CVE-2026-93515: Present Extension...

OpenSSH -- Multiple vulnerabilities

The OpenSSH project reports: sftp1: more strictly validate paths returned from the server to avoid some cases where a server could return paths that could manipulate a recursive copy operation into writing outside its target directory. sshd8: when GSSAPIAuthentication is in use, only store GSSAPI...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-53qr-784g-cj35 FastProxy backend connection pool leaks identity GHSA-cw35-4q88-3rmp NTLM/Kerberos sticky round tripper is not keyed by service GHSA-fh26-gfpp-7xxx snicheck skips the check when req.TLS is nil...

Vaultwarden -- Multiple vulnerabilities

The Vaultwarden project reports: Organization member revocation GHSA-69q9-v8p6-xvx3 High, 8.1 Two-factor authentication GHSA-7jg8-8m5x-6j9r Medium, 6.8 Organization invitations GHSA-v576-3wvq-xh3c Medium, 6.8 Attachments GHSA-q5x6-grh5-fqgc Medium, 6.5 Organization event logs GHSA-64mc-4p6f-r7x9...

Newsboat -- vulnerabilities

Newsboat Team reports: CVE ID Pending Remote code execution via manual OPML import --import-from-opml GHSA-4m8m-vj3m-hfxx: Remote code execution via OPML import both manual --import-from-opml and opml-url config setting GHSA-pvg7-gjxf-23c9: Podboat could write at arbitrary paths...

LibreSSL -- Multiple vulnerabilities

The LibreSSL project reports: Ensure verify callbacks always returning 1 can see a hostname mismatch Correct botched size check in dtls1preprocessfragment Limit size of buffered DTLS handshake messages Avoid potential overread on interrupted retransmission in DTLS Fix OCSP responder authorization...

libwasmtime -- Multiple vulnerabilities

Wasmtime development team reports: Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow. Mis-typed WebAssembly tag imports can lead to GC heap corruption. Rooting for GC values live across trycall may be missing, causing GC heap corruption...

arti -- Various security issues

Torproject reports: Various security issues discovered in versions below 2.7.0...

Apache httpd -- Multiple vulnerabilities

The Apache httpd project reports: limited RCE for some internal redirects to non-CGI files in CGI directories CVE-2026-42356 low moddav shared lock overflow CVE-2026-42528 moderate modheartmonitor denial of service CVE-2026-46729 low modsession: Session cookie not removed during internal redirect...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-12388: IdP mapper admin role escalation. CVE-2026-14781: OIDC broker applies idtoken emailverified to userinfo email, marking unverified addresses as verified. CVE-2026-19608: Name-only group claims let same-name groups satisfy path-specific group policies...

ejabberd -- Multiple security vulnerabilities

ejabberd team reports: Unauthenticated Remote Code Execution on ejabberd reported by Gia Bui when: ejabberd versions is at least 25.10 BOSH is enabled on any port S2S is enabled modadhocapi is loaded outbound connectivity from ejabberd on ports epmd default 4369, s2s default 5269 and Erlang...

FreeBSD -- Remote DoS via receive-side kernel TLS

Problem Description: TLS 1.3 embeds the actual record type as the last non-zero byte of the decrypted payload, optionally followed by zero padding. The code which searches for the inner record type had an off-by-one bug which could be triggered by an invalid frame, leading to an underflow followe...

FreeBSD -- Memory safety bugs in kqueue copy-on-fork implementation

Problem Description: When copying knotes from a parent kqueue to a child, the copy code did not correctly exclude marker knotes used internally to track list traversal position before marking them as in-flux and releasing the kqueue lock. If another thread freed a marker while the lock was droppe...

FreeBSD -- IPv6 UDP sendto(2) bypasses jail loopback restriction

Problem Description: The IPv6 UDP send path for unconnected sockets did not apply the jail policy of rewriting a loopback destination address to the jail's primary IPv6 address. Impact: A process in a classic non-VNET jail can send UDP datagrams to services listening on the host's IPv6 loopback...

FreeBSD -- Multiple jail filesystem root escapes

Problem Description: Three flaws allow a jailed process to bypass FDRESOLVEBENEATH: When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. CVE-2026-101304 renamea...

FreeBSD -- Heap out-of-bounds access in semop(2)

Problem Description: When semop2 blocks waiting for a semaphore condition, it releases the per-set lock and sleeps. Upon waking, it checks the sequence number embedded in the semaphore set's IPC identifier to detect whether the set was removed while the caller was asleep. This sequence number is...

OpenSSL -- Multiple vulnerabilities

The OpenSSL project reports: DTLS Retransmits Handshake Messages From a Stale Buffer Offset CVE-2026-84782 High Use-After-Free in X.509 Extension Cache Under Concurrent Use CVE-2026-84783 Moderate Excessive Memory Allocation in Relative CRLDP Processing CVE-2026-35189 Low QUIC Unvalidated...

RusTLS FFI -- plaintext TLS handshake vulnerability

The RusTLS project reports: TLS 1.3 handshake message processing could allow a broken peer to send plaintext handshake messages where an encrypted one is expected without rustls rejecting the connection...

conduit -- account takeover vulnerability

Conduit team reports: Fixes a vulnerability allowing an attacker with an account on the server to gain access to any other account. It is recommended you upgrade ASAP...

Gitlab -- vulnerabilities

Gitlab reports: Double Free issue in Regular Expression Parser impacts GitLab CE/EE Integer Overflow issue in Regular Expression Compiler impacts GitLab CE/EE Cross-site Scripting issue in merge request diff viewer impacts GitLab CE/EE Missing Authorization issue in Duo AI job troubleshooting...

p5-Dancer2 -- Multiple vulnerabilities

Dancer project reports: Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headerstoarray. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not...

chromium -- security fixes

Chrome Releases reports: This update includes 108 security fixes: 551573368 Critical CVE-2026-95350: Buffer overflow in ANGLE. 530045332 Critical CVE-2026-95357: Out of bounds write in GPU. 548585299 Critical CVE-2026-95339: Use after free in ServiceWorker. 551708184 Critical CVE-2026-95281: Buff...

p5-Dancer2 -- Multiple vulnerabilities

Dancer project reports: Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app. hookexception, then calls cleanup unless the failing hook is the exception handler. ...

Erlang/OTP -- multiple vulnerabilities in ssl, ssh and asn1

The Erlang/OTP project reports: OTP 29.1.1, 28.5.0.7 and 27.3.4.18 fix the following issues: CVE-2026-89422: TLS 1.3 client skips server authentication on unsolicited PSK. A presharedkey extension in the ServerHello that the client never offered causes the client to complete the handshake without...

mailpit -- Multi-frame animation bypass of thumbnail pixel budget

Mailpit author reports: The fix for CVE-2026-67446 / GHSA-75mr-qw9x-3r39 "Thumbnail generation decodes unbounded image dimensions before scaling", patched in v1.30.4 bounds only the width × height of a single frame. The decoded-size budget is still not enforced over frame count, so an animated PN...