Source
6 articles citing this source
MongoDB's CVE record lists seven fixed releases and says code execution may be possible under certain conditions. Datadog crashed a lab 8.0.34 primary with unauthenticated requests and a forced failover, without code execution.
Apache's advisory credits Anthropic's OSS Scanner and two Google Cloud researchers for CVE-2026-119618 in HTTP Server 2.4.55 through 2.4.70; Red Hat and Wiz gave different accounts of whether an exploit was public.
Canonical's LXD 6.10.1, 5.21.9, 5.0.11 and 4.0.15 and MicroCloud 3.4.1 and 2.1.5 fix a TLS certificate-chain flaw; CISA's entry in the CVE record, dated October 30, lists exploitation as none. Incus fixed it in 7.6.0.
Dalibo's PostgreSQL Anonymizer 3.3 fixes 12 CVEs. Its announcement calls them critical; the CVE records give CVSS 3.1 base scores of 3.5 to 6.5, and none of the records mentions superuser access, which the announcement cites.
Elixir 1.20.5 lists three CVE fixes in its security notes; 1.19.7 and 1.18.6 carry the URI and JSON fixes. CVE records rate each Medium under CVSS 4.0.
Docker's advisory says account conversion reassigned personal access tokens to new owners from August 2024 until a September 30, 2026 fix; it reports no evidence of exploitation.