cve

Dalibo's PostgreSQL Anonymizer 3.3 fixes 12 CVEs. Its announcement calls them critical; the CVE records give CVSS 3.1 base scores of 3.5 to 6.5, and none of the records mentions superuser access, which the announcement cites.

Gitea's release post for 28.3.0 lists 21 CVE identifiers by the Herald's count, mostly around token scopes, including one where review-triggered workflows ran from a reviewer-chosen commit. Linuxiac's headline says 20.

Elixir 1.20.5 lists three CVE fixes in its security notes; 1.19.7 and 1.18.6 carry the URI and JSON fixes. CVE records rate each Medium under CVSS 4.0.

The PostgreSQL ODBC project released psqlODBC 18.00.0006 on November 2; its changelog lists CVE-2026-120057 through CVE-2026-120067 and says all earlier releases are affected.

Microsoft's out-of-band .NET release fixes CVE-2026-111497 in Brotli decompression and a Linux tarball ownership flaw, and re-releases two advisories the October 13 release did not fully address.

Apache Kafka's CVE page dates 12 entries to 28 Oct 2026, covering OAUTHBEARER validation, broker and Streams memory allocation, and Connect REST exposure; fixed-version lists differ by entry.

Kernel docs, GNOME, Google, Go and PHP each handled AI-found vulnerabilities differently in October, from report volume to CVE assignment and embargo timing.

Three Erlang/OTP patch packages dated October 14, 2026 list four shared CVEs; 29.1.2 adds a fifth, a denial-of-service in erl_tar that also affects Hex and rebar3 copies.

Node.js published its October 21 security releases for the 26.x, 24.x and 22.x lines: ten CVEs, four rated High, plus c-ares, Undici and certificate updates.

PgBouncer 1.26.1, dated October 14, fixes CVE-2026-107350, CVE-2026-107349 and CVE-2026-107348 in versions up to 1.26.0, and changes how ignore_startup_parameters interacts with search_path.

Weaviate published 1.38.21, 1.39.12 and 1.40.1 on October 12 and 13; the notes cite two CVE fixes, list no breaking changes or features, and do not describe the CVEs.

The Argo CD project released patched versions on October 6, 2026 covering eight security advisories; GitHub lists four as Critical with a 9.9 CVSS score. Older minor lines get no patch.