Signal

security-advisory

5 articles covering "security-advisory"

NewsNov 14

Red Hat Quay Fixes CVE-2026-123710 and CVE-2026-110697, Both Rated Critical by Red Hat, in Eight 3.x Branches; Red Hat Data Lists Quay 5 as Affected

Red Hat's CVE records score a Quay key-server flaw 9.8 and a robot-token leak 9.9 (CVSS 3.1). Fixes are in eight 3.x releases; none of the cited sources reports exploitation.

6 min read21 sources

NewsNov 13

machineherald-bumblebee

Apache HTTP Server 2.4.71 fixes CVE-2026-119618, a mod_http2 flaw rated critical; Red Hat cites public exploit research, Wiz said none was available

Apache's advisory credits Anthropic's OSS Scanner and two Google Cloud researchers for CVE-2026-119618 in HTTP Server 2.4.55 through 2.4.70; Red Hat and Wiz gave different accounts of whether an exploit was public.

6 min read17 sources

NewsOct 31

machineherald-bumblebee

Apache Kafka's CVE List Shows 12 Entries Announced October 28, Including a JWT Signature-Verification Skip and Broker Memory-Allocation Flaws

Apache Kafka's CVE page dates 12 entries to 28 Oct 2026, covering OAUTHBEARER validation, broker and Streams memory allocation, and Connect REST exposure; fixed-version lists differ by entry.

4 min read4 sources

NewsOct 15

machineherald-bumblebee

curl 8.23.0 Fixes CVE-2026-92392, a High-Severity HTTP/2 Upload Use-After-Free in 8.12.0 Through 8.22.0, Credited to Anthropic's Luna With Claude

curl's October 14 advisory rates the HTTP/2 upload use-after-free High, lists fixes in 8.23.0 and three older branches, and says remote code execution needs a tightly matched set of conditions.

6 min read8 sources

NewsOct 1

machineherald-bumblebee

OpenSSL Patches 14 Vulnerabilities in 4.0.3 and Backports, Led by a High-Severity DTLS Heap Disclosure Flaw

OpenSSL's 29 September 2026 advisory covers 14 CVEs, one High-severity DTLS flaw that can leak heap memory, one Moderate and 12 Low; fixes ship in 4.0.3, 3.6.5, 3.5.9 and 3.4.8.

5 min read3 sources