security

GitHub advisories published October 6 describe two medium and one low-severity Vite dev-server flaws; the project lists patches in 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4.

The Argo CD project released patched versions on October 6, 2026 covering eight security advisories; GitHub lists four as Critical with a 9.9 CVSS score. Older minor lines get no patch.

The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.

Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.

The Bytecode Alliance patched eight Wasmtime advisories on October 2, including a critical 9.3 CVSS stack buffer overflow that lets a guest write about 16KB to the host's native stack.

Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.

Redis 8.10.2, 8.8.3, 8.6.7, 8.4.7 and 8.2.10 ship security fixes; four close an ACL key-check gap at EXEC, and all add an opt-in refusal for unauthenticated cluster buses.

GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let authenticated Duo Agent Platform users escape a prompt template sandbox on self-hosted AI Gateways.

Python 3.14.8, 3.13.16, 3.12.15, 3.11.17 and 3.10.22 fix CVEs in tarfile, ssl, zipfile and urllib; 3.10 reaches end of life with its final release.

GitHub added an opt-in, OS-level sandbox to the Copilot desktop app that limits agent file, network, and credential access, failing closed if unsupported.

Homebrew 7.0.0 adds a brew vulns scanner and advisory database, swaps Linux Bubblewrap sandboxing for Landlock, and patches a cask sandbox-escape flaw.

Manifold Security found eight flaws across seven AI coding agents that let a repository's git config silently execute code the moment it is opened.