Coverage tagged "Open source".
Posted by Robert Rothenberg on Nov 01 CVE-2026-74759 Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials…
Posted by Robert Rothenberg on Nov 01 CVE-2026-13575 CPAN Security Group CVE ID: CVE-2026-13575 Distribution: http-session Versions: before 0.54 MetaCPAN: https://metacpan.org/dist/http-session VCS…
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset…
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: r/opensource bans AI projects, and solo devs go down with them Moderators of r/opensource, Reddit’s…
Posted by Timothy Legge on Oct 31 CVE-2026-115946 CPAN Security Group CVE ID: CVE-2026-115946 Distribution: XS-libbrotli Versions: before 1.2.1.0 MetaCPAN: https://metacpan.org/dist/XS-libbrotli…
Posted by Rui Sousa on Oct 31 Hello, An additional hardening option for CVE-2026-98432 (the IPv4 TCP inet_opt use-after-free), for systems that cannot take a fixed kernel yet. The interim mitigations…
Posted by Robert Rothenberg on Oct 31 CVE-2026-78188 WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes CVE-2026-78189…
Drupal warns that attackers are exploiting a critical authorization flaw in Commerce Core, putting vulnerable online stores at risk. Drupal warns that threat actors are exploiting a highly critical…
Posted by Emmanuel Lécharny on Oct 31 Severity: critical CVSS 3.1: 9.8 (critical) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected versions: - Apache MINA 3.0.0 through 3.0.0-M2 Description…
Posted by Jens Geyer on Oct 30 Severity: important CVSS 4.0: 8.2 (high) CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected versions: - Apache Thrift…
Posted by Abhinav Agarwal on Oct 30 Hi, I reported the findings behind CVE-2026-102508 and CVE-2026-102509 [1][2]. This follow-up gives the mechanisms and triggers for both. Both are fixed in PLC4X…
Posted by Adhemerval Zanella Netto on Oct 30 The following security advisories have been published: GLIBC-SA-2026-0025: gettext: Directory traversal via the LANGUAGE environment variable The gettext…
Posted by Yash Mayya on Oct 30 Severity: moderate Affected versions: - Apache Pinot 0.7.0 before 1.6.0 Description: Incorrect Authorization vulnerability in the single-stage query engine of Apache…
Posted by Robert Rothenberg on Oct 30 CVE-2026-13576 CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes CVE-2026-118986 CallBackery versions before 0.62.0…
Posted by Robert Rothenberg on Oct 30 CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature…
Posted by Robert Rothenberg on Oct 30 CVE-2026-115865 Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory CVE-2026-115866…
Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to 2.41 and 3.0.0 versions prior…
Written by: Aurora Blum, David Mainor, Rohit Nambiar, Omar ElAhdan, Matthew McWhirt, Will Silverstone, Bhavesh Dhake, Chris Busse Introduction Recent intrusions in which threat actors have been…
Posted by Robert Rothenberg on Oct 30 CVE-2026-116130 CPAN Security Group CVE ID: CVE-2026-116130 Distribution: HTTP-Parser-XS Versions: before 0.18 MetaCPAN: https://metacpan.org/dist/HTTP-Parser-XS…
Posted by Robert Rothenberg on Oct 30 CVE-2026-118988 CPAN Security Group CVE ID: CVE-2026-118988 Distribution: CallBackery Versions: before 0.60.1 MetaCPAN: https://metacpan.org/dist/CallBackery VCS…
