Vulnerabilities
181 articles RSS
Redis and Valkey Each Ship Security Releases for a Cluster PUBLISH Heap Buffer Overflow on Messages Over 4 GB; Valkey Scores Its Advisory 8.8
Redis released seven security patches and Valkey five on October 26; Valkey's advisory GHSA-f4q9-j22m-xqq9 names an integer truncation and lists a CVSS score of 8.8.
curl Moves Minor Vulnerability Reports Public and Gentoo Seeks Sponsors, Weeks After EU Cyber Resilience Act Reporting Duties Began
Comparing curl's switch to public handling of LOW and MEDIUM reports, Gentoo's sponsor search and the EU CRA reporting regime, using the Commission, The Register, FOSS Force and curl's maintainer.
Go Blocks Trust in Compromised eMudhra Intermediate CAs Under CVE-2026-111943, and Cilium, Terraform and OpenTofu Ship Releases
Go 1.26.10 filters certificate chains through a set of eMudhra intermediates; Cilium, Terraform and OpenTofu have since released builds, and the Go thread debates the hardcoded approach.
Pillow 13.0.0 Fixes Two Maintainer-Rated Critical Flaws and an EPS Filename Bug, CVE-2026-112900, That Can Reach Ghostscript Command Execution
Pillow 13.0.0, released October 16, fixes 40 advisories published October 17, including two rated critical and an EPS filename argument injection in the Ghostscript call.
Docker Updates PHP Official and Hardened Images After the PHP2Shell Flaws, Moving the Four Supported Branches to 8.2.35, 8.3.36, 8.4.27 and 8.5.12
Docker says its PHP Official Images and Hardened Images were updated after CVE-2026-109618 and CVE-2026-109619; the DHI refresh landed within 24 hours of the upstream patches.
Ruby 4.0.9, 3.4.12 and 3.3.13 Fix Regexp Compiler Bugs Behind Four GitLab CVEs, and the Ruby Project Has Not Requested CVE IDs of Its Own
Ruby's October 23 releases fix Onigmo regular expression bugs that GitLab found could lead to remote code execution; Ruby says it has not requested CVE identifiers for them.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Fix Two Critical Unauthenticated RCE Flaws, CVE-2026-109618 and CVE-2026-109619
PHP's security release names the two CVSS 9.2 flaws as CVE-2026-109618 (OOM corruption) and CVE-2026-109619 (stale global state), fixed in four branches.
Node.js Security Releases 26.12.1, 24.22.1 and 22.23.4 Fix Ten CVEs, Four Rated High Including a Brotli Decoder Out-of-Bounds Write
Node.js published its October 21 security releases for the 26.x, 24.x and 22.x lines: ten CVEs, four rated High, plus c-ares, Undici and certificate updates.
PHP Pre-Announces October 21 Security Release for Two Critical Vulnerabilities Rated CVSS v4.0 9.2
The PHP security team says a release due October 21 at 14:00 UTC fixes two critical vulnerabilities, both CVSS v4.0 9.2, and urges users to prepare to upgrade.
Istio 1.31.2, 1.30.6 and 1.29.9 Patch an AuthorizationPolicy Method-Case Bypass Over HTTP/2 and an Ambient-Mode istiod Crash
Istio's patch releases fix a High-severity AuthorizationPolicy bypass over HTTP/2 (CVSS 7.4) and a mesh-wide istiod crash in ambient mode (CVSS 7.7), per GitHub advisories.
Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 Fix Four Medium-Severity CVEs Covering Git Sync, Prometheus Rule Conversion and Azure Monitor
Grafana's October 13 patch releases fix four CVEs rated Medium (CVSS 5.3 to 6.5) in Git Sync, the Prometheus rule conversion API and the Azure Monitor data source.
Go 1.27.2 and 1.26.9 Ship Security Fixes Including an HTTP/2 Server Crash and a CONNECT Response-Poisoning Bug in net/http
Go's October 8 point releases include security fixes to the go command, crypto/tls, html/template, net/http, net/textproto and os; Go's vulnerability database details four of the CVEs.