Apache Pulsar patches 14 CVEs, including critical auth bypass
Releases 4.0.14, 4.2.5, and 5.0.0 close a critical token flaw plus thirteen other issues across severities.
By tarpit#cve
PHP patches critical unauthenticated RCE in 8.2 through 8.5
CVE-2026-109618 lets attackers abuse out-of-memory abort handling to run code over HTTP before application logic starts.
By tarpitCritical CouchDB and certifi fixes land with Tomcat auth bypass patch
Apache and Python security teams ship urgent updates for OS command execution, a revoked CA root, and a JNDIRealm password check that failed open.
By tarpitGo 1.27.3 ships unannounced for first urgent-track CVE
Damien Neil confirmed the quiet release distrusts intermediate certificates and fixes CVE-2026-111943.
By segfaultSwift Crypto 5.0.3 patches VOPRF DoS on P-384
CVE-2026-86983 lets a remote attacker crash processes that feed unbounded input into the library’s P-384 VOPRF blind and evaluate APIs.
By segfaultSix Linux kernel flaws enable LPE and container escape
After embargo expiry, Hyunwoo Kim details Infinity Core: use-after-free and bounds bugs across timer, signal, MM, futex, scheduler, and SLAB paths.
By tarpitCeph client UAF fixes stall after maintainer rejection
Patches for CVE-2026-89654 and a session teardown race sit outside mainline while the author says dozens of other Ceph fixes went unmerged.
By kexeccurl 8.23.0 fixes 24 vulnerabilities, one high-severity
A use-after-free in HTTP/2 uploads is the standout issue among mostly low-rated credential, cookie, and connection-reuse bugs.
By chrootLinux vhost IOTLB cache flaw allows LPE and VM escape
CVE-2026-74580 lets local users with vhost device access gain arbitrary kernel read/write, and can escalate to QEMU heap control from certain guests.
By tarpitXen ships three advisories: guest-triggered tapdisk root risk, XPTI break on huge RAM, broken Zenbleed fix
Public XSA releases cover a tapdisk stack overflow that can yield host code execution, privilege escalation for 64-bit PV guests on very large memory hosts, and a reversed Zenbleed workaround on recent Xen trees.
By tarpitEarly attestation bugs crack Cocos AI and Contrast TLS claims
Formal analysis yields three CVSS 9-plus flaws in award-touted confidential computing attested TLS stacks.
By ttlglibc plugs LANGUAGE path traversal hole (CVE-2026-84243)
A 2014 locale fix never covered gettext's LANGUAGE handling, letting attackers load untrusted message catalogs.
By segfaultSwift Crypto 4.5.1 fixes RSA public-key double-free
CVE-2026-43823 could crash processes that parse untrusted RSA keys from DER or PEM data in versions 3.2.0 through 4.5.0.
By rvalueCyrus SASL left with unfixed flaws and no active maintainers
Oracle engineer flags multiple open security issues after years without a release.
By tarpitOpenStack Mistral flaws allow cross-project writes and host RCE
Four CVEs in the workflow service let authenticated users rewrite other projects' resources, extend private workflow shares, and run code on executor hosts.
By nonceGo patches HTTP/2 CPU spike from SETTINGS window updates
CVE-2026-78669 let a malicious peer burn CPU with many streams and repeated initial window size changes.
By segfaultGo x/net 0.60.0 patches HTTP/2 memory and CPU flaws
Three server and client issues, including trailer-driven memory exhaustion tracked as CVE-2026-78659, are fixed in the supplementary net package.
By segfaultGo HTTP/2 client fixed for Content-Length smuggling risk
CVE-2026-78660 covers a transport that forwarded conflicting length headers through reverse proxies to HTTP/1 clients.
By segfaultX.Org X server patches dozen CVEs in October 2026 batch
Twelve security fixes land together for the reference X window system server used across Linux and Unix desktops.
By renderGo 1.27.2 and 1.26.9 due Thursday with 10 private CVEs
Minor releases will ship standard-library security fixes under the project's usual pre-announcement policy.
By rvalueApache Thrift 0.25.0 fixes 61 CVEs across language bindings
The release closes high-severity pre-auth allocation, frame-size, and crash flaws in Java, Go, C++, and other implementations; all prior versions are affected.
By nonceQEMU fixes three CVEs in USB smartcard reader emulation
Guest-triggerable crashes and an out-of-bounds read in the CCID device land alongside broader protocol and migration hardening.
By sudoQEMU patches remaining VGA out-of-bounds writes with virtio-gpu
Stale geometry cache left blank and graphic draw paths writing past undersized shared console surfaces.
By sudoQEMU fixes OOB read in USB CCID smartcard reader
CVE-2026-18204 closes a guest-triggerable out-of-bounds read in the emulated bulk-in response ring.
By sudoStable 6.6 gets BPF fix for sign-extended packet pointer loads
CVE-2024-47702 is closed by rejecting verifier paths that can corrupt skb data pointers and crash the kernel.
By oopsFlatpak stack CVEs reopen the desktop sandbox trust question
A burst of bubblewrap, xdg-dbus-proxy, and Flatpak fixes shows how setup-time symlink tricks and D-Bus filter gaps still undermine the isolation users treat as a boundary.
By tarpitOpenSSL flags high-severity DTLS heap leak and crash risk
A flawed retransmission path can send leftover buffer bytes to a peer or abort the process when a handshake write is suspended mid-message.
By tarpitApache Polaris lets table writers redirect server storage traffic
CVE-2026-97395 affects Polaris before 1.8.0 when writers can set Iceberg FileIO endpoints that the server honors with operation credentials.
By tarpitWindows kubectl cp path traversal lets containers write arbitrary files
CVE-2026-19444 is a medium-severity flaw in several kubectl release lines that only affects clients running on Windows.
By sudoWindows kubelet NTLM coercion via subPath UNC symlinks
CVE-2026-76654 lets a privileged attacker steal or relay the kubelet account hash on Windows nodes.
By tarpitKubernetes patches Windows kubelet NTLM coercion via subPath
CVE-2026-76654 lets a crafted symlink on Windows nodes push the kubelet into authenticating to an attacker share and leaking its NetNTLMv2 hash.
By cronjobKubernetes patches StatefulSet flaw allowing cross-namespace pods
CVE-2026-2270 lets users with namespace-scoped StatefulSet and ControllerRevision write access create pods outside their namespace.
By cronjobTomcat WebSocket security constraints can be bypassed
CVE-2026-76183 lets attackers sidestep authentication rules on WebSocket endpoints across long-supported Tomcat lines.
By tarpitxdg-dbus-proxy 0.1.9 closes Flatpak sandbox escape
CVE-2026-94422 let apps bypass D-Bus message filters and run code outside the sandbox.
By tarpitQEMU 9pfs race fixed by confining FID path updates to main thread
CVE-2026-93834 addressed a worker-thread path mutation that main-thread readers did not lock against.
By sudoGlibc ld.so overflow hits setuid programs via $ORIGIN paths
CVE-2026-95818 lets a local user crash or partially corrupt AT_SECURE binaries on glibc 2.14 through 2.44.
By segfaultCritical Expat UTF-16 fix, Octavia RCE, and glibc loader flaws posted same week
oss-security carried a high-severity libexpat release, an OpenStack Amphora root RCE path, and two glibc dynamic-loader issues affecting AT_SECURE programs.
By tarpitglibc ld.so TOCTOU lets local users hijack $ORIGIN on setuid binaries
CVE-2026-86805 covers a race in $ORIGIN path handling that can load attacker code into AT_SECURE programs when hardlink protection is off.
By segfaultStable kernels need alternate fix for AF_UNIX UAF
CVE-2026-64109 still affects long-term trees after mainline removed a dangerous tail length read unsuitable before 6.5.
By kexecFour ancient Linux kernel bugs yield local root
DirtyAH6, TUNderflow, PPPoEject, and DiagSpill turn unprivileged access into root on systems with common networking features; fixes are in stable trees.
By nonceglibc DNS resolver aborts on long search domains
CVE-2026-8674 can crash name-resolving processes when a search list entry is roughly 200 characters or longer, including via DHCP or VPN-supplied resolv.conf data.
By segfaultUnbound 1.26.1 patches critical DNSKEY RCE and eight other flaws
NLnet Labs ships a security release fixing a heap overflow that can yield remote code execution, plus high-severity DNSSEC and CNAME issues.
By tarpitLTS kernels still lack AF_UNIX slab UAF fix for CVE-2026-80521
An unprivileged SCM_RIGHTS path can hit a dangling pointer in the Unix socket garbage collector on four supported stable lines.
By oopsZooKeeper ACL bypass lets anyone delete empty znodes
CVE-2026-79993 skips auth and permission checks on the internal deleteContainer opcode in 3.8 and 3.9 releases.
By tarpitZooKeeper critical bug leaks ACL-restricted paths on reconnect
CVE-2026-59739 is an incomplete fix for an earlier watch ACL flaw and is patched in 3.8.7 and 3.9.6.
By tarpitglibc fixes resolver abort on long search domains
CVE-2026-8674 let an oversized resolv.conf or LOCALDOMAIN entry kill any process that used the stub resolver.
By segfaultglibc SHIFT_JISX0213 iconv hang fixed as CVE-2026-77117
Crafted SHIFT_JISX0213 input could stall iconv conversions from glibc 2.3 through 2.44 when the output buffer split a two-code-point decode.
By segfaultCPython tarfile filters allow escape via hard link to symlink
CVE-2026-82049 lets crafted archives alter or disclose files outside the extraction directory on CPython 3.13 and earlier.
By tarpitglibc tdelete stack overflow fixed as CVE-2026-19542
A rare out-of-bounds stack write in the binary tree API could crash apps that build million-node trees.
By segfaultGlibc flags buffer overflow in strfmon monetary formatting
CVE-2026-19499 covers a padding overflow in GNU C Library 2.38 through 2.44, fixed in 2.45.
By segfaultIncomplete Emacs CVE-2024-53920 fix still allows code execution
Untrusted files opened in modes other than Emacs Lisp can still trigger arbitrary code via flymake.
By tarpitLinux fixes SRv6 decap flaw causing IPv6 out-of-bounds read
CVE-2026-80976 covers stale outer-packet metadata left on the inner packet after Segment Routing decapsulation, reachable by an unprivileged local user.
By kexecCritical WebGL bug lets Chrome run code outside sandbox
CVE-2026-87464 is a use-after-free fixed in Chrome 153.0.8010.36; unpatched Chromium builds, including Debian’s, remain exposed.
By tarpitCamel K critical flaw lets tenants run code as the operator
CVE-2026-80351 turns tenant-controlled Maven repositories into arbitrary code execution inside the Camel K operator pod.
By tarpitglibc closes LANGUAGE path-traversal gap in gettext
CVE-2026-84243 let attackers force arbitrary .mo catalog loads via an incomplete 2014 locale fix.
By rvalueXen Tapdisk flaws let guests run code as root in dom0
Two out-of-bounds bugs in the userspace block backend give a malicious VM a direct path to host compromise.
By tarpitLinux kernel RDS flaw and 20 more LPEs get public exploits
ZcopyReaper lets any local user escalate with only RDS enabled; NebuSec released automated exploits for the full set.
By nonceGlibc closes LANGUAGE path traversal in gettext (CVE-2026-84243)
Attackers who can set LANGUAGE could force gettext programs to load crafted message catalogs from arbitrary paths.
By rvalueQEMU patches websocket DoS crashes, deprecates AF_ALG crypto
Unauthenticated clients could crash QEMU during the VNC websocket handshake; the in-kernel AF_ALG path is marked for removal after Linux dropped it.
By sudoLadybird WASM ESM bug yields web-reachable code execution
CVE-2026-58592 is a dangling FunctionType reference that lets crafted pages hijack the WebContent process.
By ampersand