News · via oss-security
Re: libpng 1.6.59: Use-after-free vulnerability fixed: CVE-2026-46675
Posted by Sam James on Oct 14 Sam James writes: Hanno pointed out the tarball is there now, thanks. Any thoughts on this though?
Open source
Coverage tagged "Open source".
News · via oss-security
Re: Incomplete fix for Emacs CVE-2026-79992
Posted by Sam James on Oct 14 Sean Whitton writes: Red Hat, would you be willing to provide another CVE for this? Thank you.
News · via oss-security
[SECURITY ADVISORIES] curl 8.23.0
Posted by Daniel Stenberg on Oct 14 Hello, Today the curl project publishes a set of twenty-four separate vulnerabilities in association with the release of curl 8.23.0. All vulnerabilities have…
News · via CERT/CC
VU#166125: Bisheng has authentication bypass vulnerabilities
Overview Bisheng contains three vulnerabilities: a pre-authentication account takeover mechanism via a legacy single sign-on (SSO) endpoint; an Insecure Direct Object Reference (IDOR) vulnerability…
News · via Synacktiv
UFC 666 : Frontkick vs Rikugan
Dans le coin droit : gratuit, open source, fort de 678 étoiles sur GitHub, champion incontesté de l'agentique sous IDA et prétendant sérieux sur Binary Ninja, voici Rikugan ! Face à lui, encore…
News · via Help Net Security
Meshery: Open-source cloud-native manager for Kubernetes
Meshery is an open-source tool for designing, deploying and managing Kubernetes infrastructure, built by Layer5 and its community and hosted as a Cloud Native Computing Foundation project. Teams use…
News · via arXiv cs.CR
Argos: A Multi-Tenant SaaS Architecture for Distributed Edge Security Orchestration
arXiv:2610.14019v1 Announce Type: new Abstract: The growing adoption of distributed edge devices for security auditing and operational monitoring exposes limitations in lightweight control mechanisms…
News · via arXiv cs.CR
TrustPaper for forged PDF with Issuer Fingerprints
arXiv:2610.14132v1 Announce Type: new Abstract: Sick leave certificates are increasingly delivered as PDF files by online teleconsultation platforms, and can be altered in minutes with free editors…
News · via CERT/CC
VU#382143: Lowcoder Query Library API contains cross-tenant authorization bypass allowing for data exfiltration
Overview Lowcoder, version 2.4.10, contains an authorization bypass vulnerability in its Query Library feature’s API. Authenticated users with an admin or dev role can access private library-query…
News · via CERT/CC
VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE
Overview Shopware 6.7 contains a stored cross-site scripting (XSS) vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution…
News · via oss-security
rsyslog RainerScript replace() output length overflow (GHSA-48f2-29wv-5jgc)
Posted by Rainer Gerhards on Oct 13 Hello, rsyslog has disclosed GHSA-48f2-29wv-5jgc, an output length overflow in RainerScript replace(). The three-argument form of wrap() uses the same helper. This…
News · via oss-security
Nix and Lix: multiple vulnerabilities leading to local root privilege escalation - October 2026
Posted by Thomas GERBET on Oct 13 Hello, The Nix and Lix projects are jointly disclosing a set of vulnerabilities that can be combined to escalate privileges to root on systems running the Nix or Lix…
News · via Check Point Research
When LLM Gateways Go Wrong: Findings from LiteLLM
TL;DR; Our security assessment of LiteLLM (v1.77.7), a widely used open-source LLM gateway, uncovered multiple high-impact vulnerabilities (tracked as CVE-2026-35029, CVE-2026-59823) which have been…
News · via oss-security
Xen Security Advisory 521 v2 (CVE-2026-102701) - tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif()
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-102701 / XSA-521 version 2 tapdisk: Out-of-bounds access in tap_ctl_connect_xenblkif() UPDATES IN VERSION 2 Public release…
News · via oss-security
Xen Security Advisory 520 v2 (CVE-2026-102700) - gnttab: cache-flush handling may cause page reference leak
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-102700 / XSA-520 version 2 gnttab: cache-flush handling may cause page reference leak UPDATES IN VERSION 2 Public release…
News · via oss-security
Xen Security Advisory 519 v2 (CVE-2026-102699,CVE-2026-102702) - Arm: multiple issues with GNTTABOP_cache_flush
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-102699,CVE-2026-102702 / XSA-519 version 2 Arm: multiple issues with GNTTABOP_cache_flush UPDATES IN VERSION 2 Public…
News · via oss-security
Xen Security Advisory 518 v2 (CVE-2026-79611) - VMX: VMentry failure with branch tracing and blocked states
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-79611 / XSA-518 version 2 VMX: VMentry failure with branch tracing and blocked states UPDATES IN VERSION 2 Public release…
News · via oss-security
Xen Security Advisory 516 v2 (CVE-2026-79609) - x86: XPTI may break on huge-memory systems
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-79609 / XSA-516 version 2 x86: XPTI may break on huge-memory systems UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION…
News · via oss-security
Xen Security Advisory 515 v2 (CVE-2026-79608) - x86/AMD: ineffectual Zenbleed workaround
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-79608 / XSA-515 version 2 x86/AMD: ineffectual Zenbleed workaround UPDATES IN VERSION 2 Public release. ISSUE DESCRIPTION…
News · via oss-security
Xen Security Advisory 514 v2 (CVE-2026-79607) - Xenstore: Guests can crash xenstored during Live Update
Posted by Xen . org security team on Oct 13 Xen Security Advisory CVE-2026-79607 / XSA-514 version 2 Xenstore: Guests can crash xenstored during Live Update UPDATES IN VERSION 2 Public release. ISSUE…