Cybersecurity
353 articles RSS
Docker Says a Docker Hub Account-Conversion Flaw, CVE-2026-105445, Let Reassigned Personal Access Tokens Act as Other Users Until a September 30 Fix
Docker's advisory says account conversion reassigned personal access tokens to new owners from August 2024 until a September 30, 2026 fix; it reports no evidence of exploitation.
Storybook Patches Two Dev-Server Advisories Rated Critical and High, Changing Defaults in Versions 8 Through 11 Alpha
Storybook's maintainers published two advisories on October 12, rated critical (CVSS 9.4) and high (8.7) by the project, with fixes in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6.
SAP Cloud SDK for Python Advisory Rates an OAuth2 SSRF Flaw CVSS 10.0, With a Fix Listed as Version 0.45.2, Released August 21
A GitHub advisory published October 13 for SAP's Cloud SDK for Python lists CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF flaw, as affecting versions before 0.45.2.
GitLab 19.4.2, 19.3.4 and 19.2.8 Fix CVE-2026-97229, a CVSS 10.0 Code-Execution Flaw in the CI/CD Regular Expression Compiler
GitLab's October 12 critical patch release fixes CVE-2026-97229, rated CVSS 10.0, which GitLab says could let an unauthenticated user run code via a crafted CI/CD regular expression.
JFrog Reports Critical LMCache Flaw CVE-2026-105192, a CVSS 9.8 Pickle Deserialization Bug in Multiprocess Mode, With No Fixed Version as of October 7
JFrog's October 7 advisory rates LMCache's CVE-2026-105192 at CVSS 9.8 and lists no fixed release; a fix pull request opened October 11 was still open that day.
PostgreSQL JDBC 42.7.14 Fixes Two CVEs: A requireAuth Fail-Open Rated 5.9 and Padding That Stored Earlier Connection Traffic
pgjdbc 42.7.14 fixes CVE-2026-107314 (requireAuth fail-open, 42.7.11-42.7.13) and CVE-2026-107315 (padding with earlier connection bytes, 42.7.4-42.7.13), both rated Moderate by GitHub.
FINOS Says OSERA Is Operational With Six Premier Bank Members, a v0.1 Patch Standard and Fixes for 50-Plus Spring and Java Projects
FINOS says its bank-backed OSERA alliance is operational, with six Premier members, a first patching standard and patches for 50-plus Spring and Java projects.
Vite Patches Three Dev-Server Advisories Across Five Release Lines, With Fixes in 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4
GitHub advisories published October 6 describe two medium and one low-severity Vite dev-server flaws; the project lists patches in 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4.
Argo CD 3.5.4, 3.4.10 and 3.3.15 Fix Eight Advisories, Four Rated Critical at CVSS 9.9, Including Repo-Server Command Execution and File Reads
The Argo CD project released patched versions on October 6, 2026 covering eight security advisories; GitHub lists four as Critical with a 9.9 CVSS score. Older minor lines get no patch.
StepSecurity Says GhostAction Pushed Credential-Stealing Workflows to 345 Repositories via Two Hijacked Maintainer Accounts on October 8
StepSecurity says two hijacked maintainer accounts, including Uber athenadriver's author, pushed a credential-stealing workflow to 345 repositories on October 8; Socket counts 500+ accounts.
Checkmarx and CloudSEK Detail MALFEX, an npm Campaign With Eight Malicious Packages and 40,767 Downloads, Three of Them Still Live
Researchers say a lone operator published 12 npm packages since August 2023, eight malicious; Checkmarx found three still installable on September 29 with incomplete advisory coverage.
Django 6.1.2, 6.0.9 and 5.2.18 Patch Four CVEs, Including a Header-Parsing Denial of Service and Formset Privilege Abuse
The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.