Coverage tagged "Open source".
Posted by Shuxin Pan on Oct 13 Severity: moderate Affected versions: - Apache Fesod (Incubating) 2.0.2-incubating Description: Server-Side Request Forgery (SSRF) protection in the UrlImageConverter…
Posted by Alan Coopersmith on Oct 12 While the notes below only mention the fix for CVE-2026-95512, the CVE record for CVE-2026-50811 also lists a commit included in this release. The git log also…
Posted by Dave Brondsema on Oct 12 Severity: low Affected versions: - Apache Allura through 1.21.0 Description: OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache…
Posted by Dave Brondsema on Oct 12 Severity: moderate Affected versions: - Apache Allura through 1.21.0 Description: REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache…
Posted by Dave Brondsema on Oct 12 Severity: important Affected versions: - Apache Allura through 1.21.0 Description: OAuth1 callback validation vulnerability in Apache Allura. This issue affects…
Python 3.15 is here! Here's the essential What's new in Python 3.15 guide, this year curated by 3.14 and 3.15 release manager Hugo van Kemenade. As someone who builds open source software that works…
Overview Thelia versions 2.6.0 and 2.6.1 contain multiple vulnerabilities relating to file management, Smarty templating, module installation, and administrative workflows. Successful exploitation of…
Posted by Nebojša Jaćović on Oct 12 Hi, I'm disclosing a vulnerability in GoogleCloudPlatform/k8s-config-connector that I reported to Google Cloud VRP on 2026-06-17. The 90-day disclosure deadline I…
Posted by Nebojša Jaćović on Oct 12 Hi, I'm disclosing a vulnerability in kubernetes/cloud-provider-gcp that I reported to Google Cloud VRP on 2026-06-14 (Issue #523808414). The 90-day disclosure…
Last week on Malwarebytes Labs: ASOS breach update: Hackers stole customer details and shopping searches Attackers hijack country-code domains to impersonate Google and other services Amazon has an…
AWS released Strands Box, an open source sandbox for AI agents that pairs operating-system isolation with rules that can weigh what an agent has already done before letting it act again. Box is in…
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to…
arXiv:2610.12893v1 Announce Type: new Abstract: The rapid integration of Artificial Intelligence (AI) models has established a complex supply chain, but many of these shared artifacts harbor severe…
arXiv:2610.13071v1 Announce Type: new Abstract: Vulnerability patching is critical for safeguarding an enterprise's software ecosystem from cyber attacks. However, patching requires adequate…
Posted by Sean Whitton on Oct 11 Wonyoung Jung of 78ResearchLab, using their PatchHawk tool, discovered that the fix for CVE-2026-79992 was incomplete. The tramp-user-regexp failed to check for some…
Posted by Robert Rothenberg on Oct 10 CVE-2026-107794 CPAN Security Group CVE ID: CVE-2026-107794 Distribution: ExtUtils-Typemaps-Default Versions: before 1.07 MetaCPAN…
Posted by Robert Rothenberg on Oct 10 CVE-2026-107373 CPAN Security Group CVE ID: CVE-2026-107373 Distribution: ExtUtils-Typemaps-Default Versions: before 1.06 MetaCPAN…
Posted by Lee Rhodes on Oct 10 Severity: low Affected versions: - Apache DataSketches 2.0.0-incubating through 5.2.0 Description: Out-of-bounds read in the VarOpt union deserialization of Apache…
Posted by Lee Rhodes on Oct 10 Severity: low Affected versions: - Apache DataSketches 3.1.0 through 5.2.0 Description: Out-of-bounds read in the compact Theta sketch deserialization of Apache…
Posted by Lee Rhodes on Oct 10 Severity: moderate Affected versions: - Apache DataSketches 4.1.0 through 5.2.0 Description: Out-of-bounds read and write in the Count-Min sketch deserialization of…
