FreeBSD -- Unauthorized credential switching

Problem Description: In FreeBSD 15.0, the kernel structure used to represent user credentials changed: previously the primary group ID was stored in the first element of the array containing the list of supplementary group IDs, whereas now the primary group ID is stored in a dedicated field. This...

FreeBSD -- Multiple vulnerabilities in ppp(8)

Problem Description: ppp8 contained three memory safety errors in its handling of multilink endpoint discriminator options. mpEnddisc used incorrect length calculations when formatting endpoint discriminator addresses for display, allowing a received endpoint option to overflow a global result...

FreeBSD -- TOCTOU race in POSIX shared memory large page configuration

Problem Description: The FIOSSHMLPGCNF ioctl2 operation configures the page size for a largepage shared memory object. This is intended to be used immediately after creating the object, before any memory is allocated for the object. The handler checked whether a page size had already been...

OpenSSL -- Multiple vulnerabilities

The OpenSSL poject reports: Heap Buffer Overflow in CMS Key Unwrapping CVE-2026-63072 Moderate Invalid Pointer Dereference in CMP Server via Crafted protectionAlg CVE-2026-63076 Moderate RPK Server Signature Algorithm Selection Can Dereference a Missing Certificate CVE-2026-14457 Low Excessive...

FreeBSD -- Kernel use-after-free via the SNDCTL_DSP_SYNCSTART ioctl

Problem Description: The implementation of this ioctl attempts to acquire locks on all channels in a sync group. If locking a channel would block, it releases the sync group list lock and sleeps. Upon reawakening, it is possible that the sync group structure is freed, but the implementation did n...

FreeBSD -- Kernel use-after-free via tty ioctls

Problem Description: The TIOCSCTTY ioctl handler drops the tty lock in order to acquire the process tree lock. After reacquiring the tty lock, the handler did not revalidate the state of the terminal, and could proceed to link a terminal that was concurrently being destroyed to the calling proces...

MariaDB -- Multiple vulnerabilities

The MariaDB project reports: Details in links...

mkvtoolnix -- Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound

Moritz Bunkus reports: potential heap overflows/invalid memory access in the ODML index handling due to unsiged integer multiplication wrapping around colloquially known as "overflowing" with specifically crafted AVI files. Affects only mkvmerge as the other tools do not read AVIs...

immich -- open redirect and reflected XSS in maintenance endpoint

The immich project reports: The /maintenance endpoint fails to validate the continue URL parameter. When maintenance mode is disabled, which is the default, the application accepts unvalidated redirect targets, enabling both open redirects and reflected cross-site scripting. An unauthenticated us...

terraform -- exclusion bypass in .terraformignore handling

HashiCorp reports: Terraform bundles the go-slug library, which builds the archive uploaded to HCP Terraform or Terraform Enterprise when a run is started. In go-slug before v0.18.3, matching of .terraformignore rules does not consistently treat canonically equivalent Unicode filenames as the sam...

expat2 -- Out-of-bounds Read

https://github.com/libexpat/libexpat/pull/1331 reports: Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XMLExternalEntityParserCreate. A struct size mismatch between...

traefik -- Multiple vulnerabilities

The traefik project releases a new version addressing multiple vulnerabilities: GHSA-5w68-77r2-r64c Complete authentication bypass in the digestAuth middleware GHSA-g55h-rg46-x9c5 TLS option confusion in multi-host routers can bypass mTLS for protected hosts GHSA-j994-9gqj-9hwq Same-host Ingress...

FreeIPA -- multiple vulnerabilities

The FreeIPA project reports: CVE-2026-76578: the access control instruction for self-managed OTP tokens requires no authentication and does not restrict which attributes may be written alongside the token entry. An unauthenticated LDAP client can create a Kerberos principal and add it to the...

zeek -- multiple vulnerabilities

Tim Wojtulewicz of Corelight reports: HIGH: SMB: Chains of AndX messages can crash Zeek HIGH: DNP3: Memory exhaustion via file control g70v1 fields HIGH: SIP: Memory exhaustion from long request/response paths HIGH: DHCP: Memory exhaustion from retained options after analyzer violation HIGH: SMTP...

tailscale -- Insufficient validation of 4via6 subnet router destinations

Tailscale team reports: Insufficient validation of 4via6 subnet router destinations permitted access to host-scoped addresses, including cloud metadata and loopback services. TS-2026-11...

expat2 -- Inefficient Algorithmic Complexity

https://github.com/libexpat/libexpat/pull/1321 reports: Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear sca...

chromium -- security fixes

Chrome Releases reports: This update includes 15 security fixes: 534923522 Critical CVE-2026-76034: Buffer overflow in WebGL. 540087398 Critical CVE-2026-76036: Buffer overflow in Dawn. 516715010 High CVE-2026-76033: Inappropriate implementation in CORS. 517612295 High CVE-2026-76037: Link...

Gitlab -- Vulnerabilities

Gitlab reports: Code Injection issue via GraphQL directive impacts GitLab CE/EE Cross-Site Request Forgery issue in GraphQL multiplex query handler impacts GitLab CE/EE...

net/rsync -- multiple vulnerabilities

rsync project reports: This release fixes 33 security issues found during a focused audit of rsync's path handling and daemon protocol, a companion daemon-protocol fuzzing pass, and reports from external researchers -- plus several robustness hardenings. CVE IDs were assigned by VulnCheck CNA; th...

podman -- podman quadlet install --replace does not fully replace the old file

The Podman developers report: When running podman quadlet install --replace to replace a Quadlet file, if the original Quadlet is larger than the new Quadlet, the file would not be truncated and content from the original would be preserved...

PostgreSQL -- Multiple vulnerabilities

The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before data rows begin, processes the following data lines as psql commands. CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns ownership of dependent extended statistics objects to the current user...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site Scripting issue in Analytics Dashboards table field configuration impacts GitLab CE/EE Cross-site Scripting issue in Analytics Dashboards pagination controls impacts GitLab CE/EE GitLab Improper Authorization issue in CI/CD pipeline API impacts GitLab CE/EE Authorizatio...

chromium -- security fixes

Chrome Releases reports: This update includes 5 security fixes: 535000102 High CVE-2026-19556: Use after free in V8. 534867485 High CVE-2026-19557: Use after free in TabStrip. 536676756 High CVE-2026-19558: Use after free in Extensions. 540100588 High CVE-2026-19559: Use after free in HTML...

gitea -- Multiple vulnerabilities

Gitea reports This release addresses the following security vulnerabilities. Please upgrade as soon as possible. Unauthenticated arbitrary file read via the Org-mode INCLUDE directive. Remote code execution via the diffpatch API through Git hook installation...

OpenSSH -- Multiple vulnerbilities

The OpenSSH project reports: ssh-agent1: fix an interaction between agent locking and the [email protected] extension that is used to identify forwarded agents. ssh1: avoid potential realloc use-after-free in the client if a remote forwarding is added via the local session multiplexing...

Roundcube -- Multiple vulnerabilities

The Roundcube project reports: Missing basic validation for content proxied by the css proxy SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading islocalurl check remote content blocking bypass...

OpenEXR -- 3.4.14 fixes multiple vulnerabilities

Cary Phillips reports: The OpenEXR 3.4.14 release addresses the following security vulnerabilities: CVE-2026-68514: PyOpenEXR deep prefixed literal RGB key collision heap buffer overflow CVE-2026-68513: PyOpenEXR prefixed literal RGB key collision heap buffer overflow CVE-2026-62986: PyOpenEXR de...

chromium -- Multiple vulnerabilities

Google has released Chrome 151.0.7922.109 to address multiple critical vulnerabilities. CVE-2026-19172: Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...

chromium -- security fixes

Chrome Releases reports: This update includes 41 security fixes: 499602793 Critical CVE-2026-19137: Use after free in WebGL. 524824288 Critical CVE-2026-19149: Use after free in ura. 532941869 Critical CVE-2026-19154: Use after free in Skia. 534903095 Critical CVE-2026-19157: Out of bounds write ...

gstreamer1 -- multiple vulnerabilities

The GStreamer project reports: Multiple security issues were identified and fixed in the GStreamer framework. GStreamer-SA-2026-0067: Heap buffer overflow and memory leak in JPEG 2000 decoder GStreamer-SA-2026-0068: Heap buffer overflow in QCELP RTP depayloader GStreamer-SA-2026-0069: Heap buffer...

libXfont2 -- multiple vulnerabilities

Zhixi "Jace" Sun, independent security researcher reports: CVE-2026-44950: Font Server Client Cumulative Glyph Data Heap Buffer Overflow CVE-2026-59679: Font Server Client encoding Out-Of-Bounds Read/Write...

py-djangorestframework -- two vulnerabilities

Bruno Alla reports: Potential bypass of Django DATAUPLOADMAXMEMORYSIZE when parsing oversized JSON and urlencoded request bodies via DRF request.data AdminRenderer may disclose GET-protected data when rendering invalid write requests...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-9793: JWE request object bypasses requestObjectSignatureAlg enforcement CVE-2026-4629: Privilege escalation via hardcoded role mapper injection in manage-clients CVE-2026-14209: Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under...

jenkins -- multiple vulnerabilities

Jenkins Security Advisory 2026-08-05: SECURITY-3911 / CVE-2026-70426: Agent-to-controller deserialization filter bypass Critical SECURITY-3930 / CVE-2026-70427: Link following vulnerability allows arbitrary file creation High SECURITY-3927 / CVE-2026-70428: Path traversal vulnerability in file...

popt -- Out-of-bounds Write

https://access.redhat.com/errata/RHSA-2026:56984 reports: A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data...

phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports: The WebAuthn login flow never persists the challenge it issues, so the replay guard never runs. An attacker who captures a valid assertion can replay it to authenticate as the victim. The brute-force throttle protecting the administration two-factor prompt is scoped to the...

Weechat -- Multiple vulnerabilities

The Weechat project reports: core: fix buffer overflow in display of time in chat area with a custom time format core: fix integer overflow in size calculation when evaluating "$hide:..." and "$baseencode:..." core: fix possible buffer overflow in command /color alias core: fix possible buffer...

ejabberd -- Multiple security vulnerabilities

ejabberd team reports: It's possible to craft PLAIN auth request and authenticate as one user, but then open session for different one. modcaps persistent cache can be poisoned by using legacy version requests.This cache was only used to determine list of nodes that should trigger notifications i...

erlang -- SSH plaintext recovery attack against CBC ciphers

The Erlang/OTP team reports: The SSH client and server now reject incoming packets not aligned to the cipher block size as required by RFC 4253 section 6. For CBC ciphers, a timing-safe "packet discard" mechanism CVE-2008-5161 mitigation ensures structural errors are indistinguishable from MAC...

FreeBSD -- Missing MAC validation in wg(4) packet decryption

Problem Description: After dispatching a decrypt operation to OCF and receiving the result, the wg4 driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag. Impact: A remote attacker who can send UDP...

Gitlab -- vulnerabilities

Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass Assignment issue in Pipeline Schedule API impacts GitLab CE/EE Denial of Service issue in Merge Request Discussions impacts GitLab CE/EE Race Condition issue in merge request approval rules impacts GitLab ...

FreeBSD -- Kernel stack disclosure via timer_settime(2)

Problem Description: To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized output...

FreeBSD -- Heap out-of-bounds access in semctl(2)

Problem Description: The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been replaced ...

FreeBSD -- Use-after-free in kqueue copy-on-fork

Problem Description: While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting the acti...

NetBird -- Local Privilege Escalation via Unauthenticated IPC Socket

The NetBird Team reports: The NetBird client daemon exposes its gRPC control interface to any local process with no authentication, in all versions from 0.5.0 March 2022 to 0.75.1. On Linux, macOS and FreeBSD the interface is a Unix domain socket /var/run/netbird.sock with world-readable/writable...

chromium -- security fixes

Chrome Releases reports: This update includes 370 security fixes: 514442821 Critical CVE-2026-17650: Use after free in Compositing. 517307966 Critical CVE-2026-17651: Insufficient validation of untrusted input in Dawn. 519262990 Critical CVE-2026-17652: Use after free in Views. 520514458 Critical...

FreeBSD -- ktrace(2) privilege incorrectly validated in jails

Problem Description: As an inadvertent side effect of an unrelated code change, PRIVKTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. Impact: An unprivileged user in a jail that has permission to debug the target...

FreeBSD -- Race condition in ELF core dump segment counting

Problem Description: The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two passes,...

DNSDist, PowerDNS, PowerDNS Recursor -- vulnerability

CVE-2026-52682: A crafted DNS packet can cause increased memory and CPU consumption...

mailpit -- WebSocket origin check bypass via percent-encoded path

Mailpit author reports: The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go's ServeMux routes on the percent-decoded path, so requesting /%61pi/events reaches the WebSocket handler while skipping the only origin control, and the...