Vulnerability Disclosure

Chrome 157 states 213 security fixes and Rails 21 security issues, while Gitea 28.3's post states no total and lists 21 CVE entries; Linuxiac reported 20 for Gitea.

Reporting on the Brotli decoder flaw CVE-2026-111497 shows fixes, scanner coverage and exploitation status differing across Node.js, .NET, Python packages and others.

Kernel docs, GNOME, Google, Go and PHP each handled AI-found vulnerabilities differently in October, from report volume to CVE assignment and embargo timing.

Comparing curl's switch to public handling of LOW and MEDIUM reports, Gentoo's sponsor search and the EU CRA reporting regime, using the Commission, The Register, FOSS Force and curl's maintainer.

Google's Open Source Software Vulnerability Reward Program stopped accepting product vulnerability reports as of October 1, 2026, with an update promised in Q1 2027.

A bug-bounty researcher showed a paying Cloudflare Containers customer could recover up to 60 KB of leftover disk data from other customers' deleted containers; Cloudflare says it found no evidence of exploitation.

Wiz's autonomous Red Agent found and exploited a GitHub Actions injection flaw in a Snowflake repo that GitHub's own scanner had missed, exfiltrating a live Jira token.

Microsoft's bounty program paid over $20 million to 562 researchers this year after expanding scope to cover open-source software and third-party components.

An unauthenticated API flaw in the Pope's official prayer app exposed names, emails, and birth dates of over 719,000 users for six months before a fix.

An LLM-powered scanner from security startup DepthFirst flagged a heap buffer overflow that had sat undetected in NGINX's rewrite module for roughly 18 years, prompting F5 to ship coordinated patches on May 13.