Vulnerabilities
146 articles RSS
Go 1.27.2 and 1.26.9 Ship Security Fixes Including an HTTP/2 Server Crash and a CONNECT Response-Poisoning Bug in net/http
Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.
Node.js Pre-Announces October 21 Security Releases for 26.x, 24.x and 22.x With a Highest Severity of High, as 26.12.0 and 24.22.0 Ship
Node.js says new 26.x, 24.x and 22.x releases will land on or shortly after October 21 to fix vulnerabilities, highest severity High; 26.12.0 and 24.22.0 shipped October 14.
OpenTofu 1.12.8 Release Notes List a Go HTTP/2 CPU-Usage Fix for tofu init, While a Maintainer Proposes Shipping the v1.13 Backport in 1.13.2
OpenTofu 1.12.8, published October 14, 2026, lists an HTTP/2 excessive-CPU fix for tofu init; a maintainer's pull request proposes shipping the v1.13 fix in 1.13.2.
PgBouncer 1.26.1 Fixes Three CVEs, Including a SCRAM Flaw That Lets a User Who Knows One Password Log In as Others
PgBouncer 1.26.1, dated October 14, fixes CVE-2026-107350, CVE-2026-107349 and CVE-2026-107348 in versions up to 1.26.0, and changes how ignore_startup_parameters interacts with search_path.
curl 8.23.0 Fixes CVE-2026-92392, a High-Severity HTTP/2 Upload Use-After-Free in 8.12.0 Through 8.22.0, Credited to Anthropic's Luna With Claude
curl's October 14 advisory rates the HTTP/2 upload use-after-free High, lists fixes in 8.23.0 and three older branches, and says remote code execution needs a tightly matched set of conditions.
containerd Patches Four Moderate Advisories on October 13 Across 2.4, 2.3, 2.2 and 2.0, With 2.0.14 Carrying Only a Disk-Exhaustion Fix
containerd 2.4.2, 2.3.7, 2.2.10 and 2.0.14 shipped October 13 with fixes for four Moderate-rated advisories, split unevenly by branch; 2.0.14 lists one.
Storybook Patches Two Dev-Server Advisories Rated Critical and High, Changing Defaults in Versions 8 Through 11 Alpha
Storybook's maintainers published two advisories on October 12, rated critical (CVSS 9.4) and high (8.7) by the project, with fixes in 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6.
SAP Cloud SDK for Python Advisory Rates an OAuth2 SSRF Flaw CVSS 10.0, With a Fix Listed as Version 0.45.2, Released August 21
A GitHub advisory published October 13 for SAP's Cloud SDK for Python lists CVE-2026-89111, a CVSS 10.0 OAuth2 SSRF flaw, as affecting versions before 0.45.2.
GitLab 19.4.2, 19.3.4 and 19.2.8 Fix CVE-2026-97229, a CVSS 10.0 Code-Execution Flaw in the CI/CD Regular Expression Compiler
GitLab's October 12 critical patch release fixes CVE-2026-97229, rated CVSS 10.0, which GitLab says could let an unauthenticated user run code via a crafted CI/CD regular expression.
JFrog Reports Critical LMCache Flaw CVE-2026-105192, a CVSS 9.8 Pickle Deserialization Bug in Multiprocess Mode, With No Fixed Version as of October 7
JFrog's October 7 advisory rates LMCache's CVE-2026-105192 at CVSS 9.8 and lists no fixed release; a fix pull request opened October 11 was still open that day.
PostgreSQL JDBC 42.7.14 Fixes Two CVEs: A requireAuth Fail-Open Rated 5.9 and Padding That Stored Earlier Connection Traffic
pgjdbc 42.7.14 fixes CVE-2026-107314 (requireAuth fail-open, 42.7.11-42.7.13) and CVE-2026-107315 (padding with earlier connection bytes, 42.7.4-42.7.13), both rated Moderate by GitHub.
Vite Patches Three Dev-Server Advisories Across Five Release Lines, With Fixes in 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4
GitHub advisories published October 6 describe two medium and one low-severity Vite dev-server flaws; the project lists patches in 8.3.3, 8.2.4, 8.1.6, 7.3.7 and 6.4.4.