Coverage tagged "Open source".
Posted by Timothy Legge on Oct 23 CVE-2026-115936 CPAN Security Group CVE ID: CVE-2026-115936 Distribution: IO-Compress-Brotli Versions: from 0.004001 before 0.023 MetaCPAN…
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124701, "Fix out-of-bounds reads with corrupt OptimizedTranslation data", merged to master on…
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124699, "Fix heap overflow with invalid string length in binary resources", merged to master on…
Posted by Tomasz Kaye on Oct 23 Follow-up: the fix for this issue has been merged upstream. PR #124697, "Fix out-of-bounds write when loading corrupt HDR images", merged to master on 2026-10-20…
Posted by Robert Rothenberg on Oct 23 CVE-2026-113877 CPAN Security Group CVE ID: CVE-2026-113877 Distribution: HTTP-Headers-ActionPack Versions: before 0.10 MetaCPAN…
Posted by Alan Coopersmith on Oct 23 https://www.ruby-lang.org/en/news/2026/10/23/regexp-fixes-for-gitlab-cves/ says:
Posted by Alan Coopersmith on Oct 23 https://www.php.net/archive/2026.php#2026-10-23-1 advises:
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder. Together they cover an authentication bypass (CVE-2026-93680)…
arXiv:2610.30226v1 Announce Type: new Abstract: Phishing relies on visual deception, traditionally requiring web-development skills or pre-built kits.
arXiv:2610.30418v1 Announce Type: new Abstract: Modern LLM agents can retrieve information from accessible documents, and then disclose a sensitive conclusion assembled from them. This mosaic effect…
Overview Two critical memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP…
Shadow AI used to be confined to a few simple scenarios, such as AI chatbots and AI browser extensions. Today, it spans a broad spectrum of complex vectors, making it harder to detect and control. In…
Industry News, Explained The AI industry is slowly blinding itself to what its own models are thinking OpenAI and Anthropic have each separately disclosed a real security incident this year where a…
Serial Number: AV26-1075 Date: October 22, 2026 As of October 19, 2026, Roundcube is affected by vulnerabilities in the following product: Roundcube Webmail Prior to 1.6.20 Prior to 1.7.5 The Cyber…
Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.
Cisco heeft meerdere kwetsbaarheden verholpen in Snort 3, het open source intrusion detection en prevention systeem dat in diverse Cisco-producten wordt gebruikt. De kwetsbaarheden bevinden zich in…
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on…
Oracle heeft meerdere kwetsbaarheden verholpen in diverse producten, waaronder Oracle SOA Suite, Oracle WebLogic Server, Oracle Data Integrator, Oracle Identity Manager, Oracle Access Manager, Oracle…
Software can expose complex functionality to unauthenticated users even when that functionality is disabled or unnecessary. Anthropic’s Frontier Red Team used Claude to examine 25 open-source…
A flaw in Signal’s calling library could let the other person on a call keep receiving a user’s audio, and possibly video, after that user hangs up. Tracked as CVE-2026-113380, the vulnerability…
