Vulnerabilities
181 articles RSS
PostgreSQL Anonymizer 3.3 fixes 12 CVEs that Dalibo calls critical; CVE records score them 3.5 to 6.5
Dalibo's PostgreSQL Anonymizer 3.3 fixes 12 CVEs. Its announcement calls them critical; the CVE records give CVSS 3.1 base scores of 3.5 to 6.5, and none of the records mentions superuser access, which the announcement cites.
Rails 8.1.4.1 and 8.0.5.2 Fix 21 Security Issues, Led by a Critical Active Storage ImageMagick File-Write Flaw, GHSA-f3w6-w445-fwh9
Rails says 8.1.4.1 and 8.0.5.2 fix 21 issues; the advisory for the Critical one says a crafted upload may let an unauthenticated attacker write files via ImageMagick.
Gitea 28.3.0 Lists 21 CVE Identifiers, Mostly Around Token Scopes, and Moves Review-Triggered Workflows to the Pull Request Head
Gitea's release post for 28.3.0 lists 21 CVE identifiers by the Herald's count, mostly around token scopes, including one where review-triggered workflows ran from a reviewer-chosen commit. Linuxiac's headline says 20.
Elixir 1.20.5, 1.19.7 and 1.18.6 Fix Two Denial-of-Service CVEs in URI.parse and JSON.decode; 1.20.5 Also Fixes a Mix deps.partition Flaw
Elixir 1.20.5 lists three CVE fixes in its security notes; 1.19.7 and 1.18.6 carry the URI and JSON fixes. CVE records rate each Medium under CVSS 4.0.
OCaml 5.5.2 Fixes Six OSEC Advisories, Including Marshal Demarshaling and Windows Command Quoting; Each Advisory Credits Anthropic as Reporter
OCaml 5.5.2, tagged October 23, 2026, fixes six OSEC advisories in Str, Unix.map_file, Marshal, Windows command quoting and runtime_events, plus four other bugs including two miscompilations.
psqlODBC 18.00.0006 Fixes Vulnerabilities Including an SQL Injection in SQLSpecialColumns and Several Buffer Overflows; All Earlier Releases Affected
The PostgreSQL ODBC project released psqlODBC 18.00.0006 on November 2; its changelog lists CVE-2026-120057 through CVE-2026-120067 and says all earlier releases are affected.
Hacktron Reports a GNU Savannah Flaw That Could Have Given Push Access to Bash, and Says the FSF Fixed 26 Vulnerabilities in the Forge
Hacktron's write-up says a shell injection in the Savane forge software behind GNU Savannah, reported to the FSF on May 11, 2026, could have been chained to push access to Bash; the firm says it did not touch the repository.
.NET 8.0.33, 9.0.22 and 10.0.14 Ship Out-of-Band Fixes for a Brotli Buffer Overflow, CVE-2026-111497, Alongside .NET 11 Release Candidate 3
Microsoft's out-of-band .NET release fixes CVE-2026-111497 in Brotli decompression and a Linux tarball ownership flaw, and re-releases two advisories the October 13 release did not fully address.
Apache Kafka's CVE List Shows 12 Entries Announced October 28, Including a JWT Signature-Verification Skip and Broker Memory-Allocation Flaws
Apache Kafka's CVE page dates 12 entries to 28 Oct 2026, covering OAUTHBEARER validation, broker and Streams memory allocation, and Connect REST exposure; fixed-version lists differ by entry.
Next.js 16.4.1 and 15.5.28 Fix Two Critical RCE Advisories and a High-Severity DoS, Including Two Fixes Postponed From September
Next.js published an out-of-band update on October 14 for two critical unauthenticated RCE advisories and one high-severity DoS, and has announced a November 3 release of seven medium fixes.
Disclosure Rules Shift Around AI-Found Bugs: Kernel Docs Say Treat Them as Public, GNOME Ended Its Bounty, Google Paused OSS Rewards
Kernel docs, GNOME, Google, Go and PHP each handled AI-found vulnerabilities differently in October, from report volume to CVE assignment and embargo timing.
Erlang/OTP 29.1.2, 28.5.0.8 and 27.3.4.19 Fix TLS, X.509 and httpc CVEs, and 29.1.2 Also Fixes an erl_tar Infinite Loop
Three Erlang/OTP patch packages dated October 14, 2026 list four shared CVEs; 29.1.2 adds a fifth, a denial-of-service in erl_tar that also affects Hex and rebar3 copies.