Vulnerabilities
181 articles RSS
Ubuntu Plans Effectively Weekly Kernel Releases, Oracle Moves Toward Monthly Java Updates, and Four Debian Kernel Advisories Differ Widely in Size
Canonical and Oracle link shorter security-update intervals to AI-assisted bug discovery; Debian's four kernel advisories since September 29 list 3 to 1,313 CVE IDs, and one CVE reached Ubuntu 25 days after Debian's advisory (Herald counts).
MongoDB Fixes CVE-2026-118383, Which It Scored 9.5: Datadog Crashed a Lab Replica Set Primary With Unauthenticated Requests and a Forced Failover
MongoDB's CVE record lists seven fixed releases and says code execution may be possible under certain conditions. Datadog crashed a lab 8.0.34 primary with unauthenticated requests and a forced failover, without code execution.
Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a mod_http2 flaw rated critical; Red Hat cites public exploit research, Wiz said none was available
Apache's advisory credits Anthropic's OSS Scanner and two Google Cloud researchers for CVE-2026-119618 in HTTP Server 2.4.55 through 2.4.70; Red Hat and Wiz gave different accounts of whether an exploit was public.
Git 2.56.1 and Six Backport Releases Fix Six CVEs, Including CVE-2026-111760, Which Can Run Attacker Code During Recursive Clones
Git 2.56.1 and backports to the 2.50 through 2.55 series fix six CVEs announced November 10, 2026; Git for Windows 2.56.1 was published at 22:13 UTC that day.
VulnCheck Honeypots Saw CVE-2026-58115 Exploited via Node-RED on October 30; Siemens-Sourced NVD Record Now Names Four IoT2050 Models, Up From One
Honeypots run by VulnCheck logged exploitation of CVE-2026-58115 between October 30 and November 1. The Siemens-sourced CVSS 10.0 NVD record names four IoT2050 models; GitHub's August copy named one.
RunSybil Says a CPython Bug Lets Chat Templates Escape Jinja Sandboxes; Python Security Team Does Not Consider the Escape a CPython Vulnerability
RunSybil says a CPython memory bug lets model chat templates escape Jinja sandboxes; Python's security team does not consider the demonstrated escape a CPython vulnerability. The crash fix shipped in 3.13.16, 3.14.8 and 3.15.0 release candidate 2.
LXD and MicroCloud Fix CVE-2026-112816, Rated CVSS 10.0, Which Let a Client Pose as a Trusted Client Without Its Private Key; Incus Also Fixes It
Canonical's LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5 fix a TLS certificate-chain flaw; CISA's entry in the CVE record, dated October 30, lists exploitation as none. Incus fixed it in 7.6.0.
Chrome 157, Rails and Gitea Security Releases in November 2026: Fix Counts Rest on Bug Entries, Advisories and CVE Lists
Chrome 157 states 213 security fixes and Rails 21 security issues, while Gitea 28.3's post states no total and lists 21 CVE entries; Linuxiac reported 20 for Gitea.
kaniko Before v1.25.20 Can Send Azure Entra ID Tokens to Lookalike Registry Hosts (CVE-2026-105769); Go Database Lists No Upstream Fix
A GitHub advisory says kaniko before v1.25.20 can send an Entra ID token to a lookalike registry host named in a Dockerfile; the Go vulnerability database lists no fixed version of the upstream helper.
Debian and Ubuntu Fix CVE-2026-109518, an APT Flaw in Download Retries That Lets an On-Path Attacker Install Unverified Packages
Debian, Ubuntu and APT's developers published fixes on November 4 for CVE-2026-109518, which needs an attacker on the HTTP path and a non-zero Acquire::Retries setting.
OpenSSH 10.6p2 Fixes a Password Authentication Bypass Affecting musl-Based Linux Systems With PAM Disabled, Including Alpine Linux
OpenSSH's 10.6p2 release, dated 2026-11-05, works around a password bypass on musl-based Linux without PAM; BleepingComputer names Alpine Linux among affected systems.
Chrome 157 Stable Carries 213 Security Fixes, Seven Rated Critical, Including Two in Dawn and One Each in ANGLE and WebGL
Google promoted Chrome 157 to stable with 213 security fixes, seven rated critical; SecurityWeek reports no mention of exploitation in the wild.