Vulnerabilities
181 articles RSS
Django 6.1.2, 6.0.9 and 5.2.18 Patch Four CVEs, Including a Header-Parsing Denial of Service and Formset Privilege Abuse
The Django project's October 6 security releases fix one low and three moderate issues, plus a bypass of an earlier nested-geometry mitigation; the post lists severity but no CVSS scores.
Gradle 9.8.1 Patches Three High-Rated Vulnerabilities, Two Involving Unsafe Java Deserialization in Its Build Daemon Channels
Gradle 9.8.1 fixes three high-rated flaws: two Java deserialization bugs in daemon communication and an SSL-failure repository fallback, plus three 9.8.0 regressions.
Google Pauses Product Vulnerability Rewards in Its Open-Source Bug Bounty, Citing a Rise in Automated Submissions
Google's Open Source Software Vulnerability Reward Program stopped accepting product vulnerability reports as of October 1, 2026, with an update promised in Q1 2027.
OpenSSH 10.6 Disables LZ77 Compression Over a Plaintext-Recovery Attack, Enables Hybrid Post-Quantum Signatures and Deprecates scp -R
OpenSSH 10.6 disables the LZ77 coder in ssh and sshd to mitigate a CCS 2026 compression side channel, enables ssh-mldsa44-ed25519 signatures, and starts deprecating scp -R.
Atlassian Patches Critical CVE-2026-21589 File-Read Flaw Across Bitbucket, Jira, Bamboo and Five Other Data Center Products
Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal letting unauthenticated attackers read known files in eight self-hosted products, with fixes listed for each.
Wasmtime 49.0.2 and 48.0.4 Fix Eight Advisories, Led by a Critical Stack Overflow in Async Component Callbacks
The Bytecode Alliance patched eight Wasmtime advisories on October 2, including a critical 9.3 CVSS stack buffer overflow that lets a guest write about 16KB to the host's native stack.
pgvector 0.8.7 Fixes an IVFFlat Index-Build Buffer Overflow, CVE-2026-103484, That Can Lead to Arbitrary Code Execution
pgvector 0.8.7 fixes CVE-2026-103484, a buffer overflow in IVFFlat index builds affecting 0.8.6 and earlier; users are urged to upgrade.
Angular Patches Four Server-Side Rendering Advisories in Eight Days, Three Rated High, Across Versions 20, 21 and 22
Angular's maintainers published four GitHub advisories between September 23 and October 1 covering router and platform-server flaws in server-side rendering, three rated High.
Redis Patches ACL Transaction Bypass and Unauthenticated Cluster Bus Across Five Release Branches
Redis 8.10.2, 8.8.3, 8.6.7, 8.4.7 and 8.2.10 ship security fixes; four close an ACL key-check gap at EXEC, and all add an opt-in refusal for unauthenticated cluster buses.
GitLab Patches Critical Self-Hosted AI Gateway Flaw CVE-2026-90970, a CVSS 9.9 Prompt-Template Sandbox Escape
GitLab fixed CVE-2026-90970, a CVSS 9.9 flaw that let authenticated Duo Agent Platform users escape a prompt template sandbox on self-hosted AI Gateways.
OpenSSL Patches 14 Vulnerabilities in 4.0.3 and Backports, Led by a High-Severity DTLS Heap Disclosure Flaw
OpenSSL's 29 September 2026 advisory covers 14 CVEs, one High-severity DTLS flaw that can leak heap memory, one Moderate and 12 Low; fixes ship in 4.0.3, 3.6.5, 3.5.9 and 3.4.8.
Next.js 16.3.8 and 15.5.27 Patch Seven Vulnerabilities, Including a High-Severity Image Optimizer SSRF, While Two Others Slip
Vercel's Next.js team released 16.3.8 and 15.5.27 fixing one high, five medium and one low severity flaw; a critical and a high fix were postponed over upstream delays.