// security

$ tail -f ./security

Headlines from early disclosure channels, research labs and curated news, each with a short summary.

live updated 23 Oct, 22:37
last 24 h 73 headlines
sources 37

# Today

  1. oss-security early signals infra

    Ruby Regexp compilation fixes related to GitLab's CVE's

    Ruby released Regexp compilation fixes related to GitLab CVEs.

    seclists.org
  2. oss-security early signals infra

    PHP Informational advisory: Session upload progress (CVE-2026-115560)

    PHP published an informational security advisory for CVE-2026-115560, which affects session upload progress functionality.

    seclists.org
  3. oss-security early signals

    CVE-2026-115748: Apache Vysper: Authorization bypass

    A security advisory reports an authorization bypass in Apache Vysper, an XMPP server library, affecting all versions and allowing authenticated users to compromise other accounts.

    seclists.org
  4. oss-security early signals

    CVE-2026-115721: Apache Vysper: Unbounded allocation

    A CVE describes unbounded XML parsing allocation in the retired Apache Vysper XMPP server library, potentially causing out-of-memory conditions.

    seclists.org
  5. oss-security early signals

    CVE-2025-60497: NULL pointer dereference in GPAC/MP4Box GetESD via crafted MP4 input

    A medium-severity CVE-2025-60497 describes a NULL pointer dereference in GPAC MP4Box GetESD triggered by crafted MP4 input, causing denial of service.

    seclists.org
  6. oss-security early signals

    CVE-2025-60494: invalid memory read in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input

    A CVE describes an invalid memory read in GPAC MP4Box when processing crafted MP4 files, potentially causing denial of service.

    seclists.org
  7. oss-security early signals

    CVE-2025-60492: uncontrolled recursion in GPAC/MP4Box BIFS decoder via crafted MP4 input

    A CVE describes uncontrolled recursion in GPAC MP4Box BIFS decoder triggered by crafted MP4 files, causing stack exhaustion.

    seclists.org
  8. oss-security early signals

    CVE-2025-60491: heap use-after-free in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input

    A heap use-after-free in GPAC MP4Box's dasher_flush_segment function can be triggered by crafted MPEG-2 TS input, assigned CVE-2025-60491.

    seclists.org
  9. oss-security early signals

    CVE-2025-60490: heap use-after-free in GPAC/MP4Box gf_filter_pid_send_event_downstream via crafted MPEG-2 TS input

    A heap use-after-free vulnerability in GPAC MP4Box can be triggered by crafted MPEG-2 Transport Stream input and has been assigned CVE-2025-60490.

    seclists.org
  10. oss-security early signals

    CVE-2025-60489: NULL pointer dereference in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input

    CVE-2025-60489 is a NULL pointer dereference in GPAC MP4Box triggered by crafted MP4 input, causing a denial of service; a fix is available.

    seclists.org
  11. oss-security early signals

    CVE-2025-60487: NULL pointer dereference in GPAC/MP4Box gf_isom_get_esd via crafted XML input

    A null pointer dereference in GPAC MP4Box may cause a denial of service when processing crafted XML input.

    seclists.org
  12. oss-security early signals

    CVE-2026-101259: Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions

    Apache Camel CoAP component versions before 4.18.5 and 4.22.2 can expose sensitive information through unmuted consumer exceptions.

    seclists.org
  13. oss-security early signals infra

    CVE-2026-95664: Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions

    CVE-2026-95664 affects Apache Camel’s AWS2-S3 producer, which evaluates untrusted S3 object keys from the CamelAwsS3Key header as simple expressions.

    seclists.org
  14. oss-security early signals

    CVE-2026-95663: Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry

    A vulnerability in Apache Camel’s Keycloak component can accept expired access tokens because cached introspection results are not limited by token expiry.

    seclists.org
  15. oss-security early signals

    CVE-2026-95629: Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory

    A path traversal vulnerability in Apache Camel Docling can allow remote authenticated users to write conversion output to arbitrary directories.

    seclists.org
  16. oss-security early signals

    CVE-2026-95628: Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)

    Apache Camel Docling component has a path traversal vulnerability in versions 4.15.0 before 4.18.5 and 4.19.0 before 4.22.2, affecting custom CLI argument validation.

    seclists.org
  17. oss-security early signals

    CVE-2026-94386: Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache

    CVE-2026-94386 affects Apache Camel OAuth component versions 4.19.0 through 4.22.1, where a token cache may reuse credentials across scopes.

    seclists.org